Chunk-Based Key Rotation for Encrypted Cloud Files

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The existing methods for revoking access to encrypted data in cloud storage are often complicated, time-consuming, and prone to errors, particularly due to network connection issues and the need for additional clean-up processes, which can lead to security vulnerabilities.

Innovation Solution

The method involves obtaining and generating cryptographic keys on a user device, decrypting and re-encrypting data in chunks, and uploading them back to the remote server, eliminating the need for persistent storage and reducing the risk of data leaks by using non-persistent storage and parallel processing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional key revocation methods are used, then access can be revoked, but the process is complicated and time-consuming

Engineering Contradiction:

Improveaccess revocation reliabilityVSAvoidkey rotation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The encrypted file is divided into multiple chunks that are processed independently. Each chunk is decrypted and re-encrypted separately, allowing parallel processing and reducing overall key rotation time while maintaining security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A new cryptographic key is generated before the actual key rotation process begins. This preliminary key generation enables seamless transition without interrupting service, as the new key is ready to replace the old one immediately after verification.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If traditional key revocation methods are used, then access can be revoked, but the process is complicated with additional clean-up steps

Engineering Contradiction:

Improveaccess revocation reliabilityVSAvoidkey rotation process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system automatically manages the entire key rotation process including chunk processing, key replacement, and cleanup of temporary files. This self-service approach eliminates manual intervention and reduces process complexity while maintaining high reliability.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Temporary decrypted chunks are discarded immediately after re-encryption without being stored persistently. This automatic discarding of intermediate data simplifies the process by eliminating manual cleanup steps and reduces security risks associated with temporary file management.

Inventive Principle:

Principle #34Discarding and recovering

3Ease of operation

If data is stored persistently during key rotation, then processing is easier, but security risk increases due to potential data leaks

Engineering Contradiction:

Improvekey rotation easeVSAvoiddata leak risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system uses non-persistent storage for temporary decrypted chunks, treating them as disposable data that exists only momentarily in memory. This approach maintains ease of operation while dramatically reducing security risk, as the data cannot be recovered from persistent storage after processing.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The decrypted chunks are processed and re-encrypted in rapid succession without being written to persistent storage. This rushing through the vulnerable state minimizes the window of exposure while maintaining operational simplicity through automated memory management.

Inventive Principle:

Principle #21Skipping (Rushing through)

4Quantity of substance

If sequential processing is used, then resource requirements are lower, but productivity decreases

Engineering Contradiction:

Improvememory usageVSAvoidkey rotation speed

Core Design Contradiction:

Quantity of substanceVSProductivity

Solution Approach 1:

The file is segmented into chunks that can be processed in parallel. This segmentation enables multiple processing threads to work simultaneously on different chunks, increasing key rotation speed while keeping individual chunk memory requirements manageable.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system loads a limited number of chunks into memory at once (partial action) rather than the entire file, enabling parallel processing of multiple chunks while controlling memory usage. This approach achieves high productivity without excessive resource consumption.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11601270B1Methods, systems and computer program products for rotating cryptographic keys for encrypted files

Publication Date: 2023.03.07 UAB 360 IT

AI summary

Methods for rotating cryptographic keys to revoke access to encrypted data stored on a remote server. Obtaining a first cryptographic key from a key store. Generating a second cryptographic key at a user device. Obtaining a first chunk of data from an encrypted file stored on the remote server. Decrypting the first chunk of data using the first cryptographic key to provide a decrypted first chunk of data. Re-encrypting the decrypted first chunk of data using the second cryptographic key to provide a re-encrypted first chunk of data. Uploading the re-encrypted first chunk of data to the remote server from non-persistent storage. Repeating the steps until an entire encrypted file has been decrypted and re-encrypted. Combining all the re-encrypted chunks of the encrypted file to provide a reassembled encrypted file that is associated with the second cryptographic key. Updating the remote server with the reassembled encrypted file associated with the second cryptographic key. Storing the second cryptographic key in place of the first cryptographic key.