Client-Side Encryption Offloading for Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage systems waste computational resources when implementing both at-rest and encryption-on-wire data encryption, as they decrypt and re-encrypt data during transmission and storage.
Innovation Solution
Offloading encryption to remote clients by using a security server that creates public/private key pairs and ephemeral single-use keys, allowing clients to encrypt data and keys, while the server only manages key re-encryption for at-rest storage, thereby avoiding unnecessary decryption and re-encryption of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional storage systems implement both at-rest and encryption-on-wire data encryption, then data security is improved, but computational resource usage increases
Solution Approach 1:
The patent extracts the data encryption operation from the storage system and relocates it to the client system. The client performs encryption before data transmission, and the storage system only handles key management and decryption when needed, eliminating the wasteful decrypt-then-re-encrypt cycle that consumed excessive computational resources.
Solution Approach 2:
The patent introduces a key management intermediary that separates the encryption of data from the storage operations. The client uses asymmetric cryptography to encrypt data with a symmetric key, which is then encrypted with the storage system's public key. This intermediary key structure allows the storage system to avoid processing the actual data encryption/decryption operations.
2Reliability
If storage systems decrypt and re-encrypt data during transmission and storage, then encryption-on-wire and at-rest encryption are achieved, but computational resources are wasted
Solution Approach 1:
The patent applies preliminary action by having the client perform data encryption before transmission to the storage system. The client generates a symmetric key, encrypts the data with this key, and then encrypts the symmetric key with the storage system's public key. This preliminary encryption at the client side eliminates the need for the storage system to decrypt and re-encrypt the data, improving computational efficiency while maintaining encryption protection.
3Reliability
If the storage system performs all encryption and decryption operations, then data protection is maintained, but system complexity increases
Solution Approach 1:
The patent implements self-service by enabling the client to perform encryption operations locally using its own computational resources. The client generates symmetric keys, encrypts data, and manages its own encryption/decryption operations. This self-service approach reduces the complexity burden on the storage system while maintaining comprehensive data protection.
Data Source
AI summary
Exemplary methods for offloading encryption to a client include receiving from a first client a first encrypted data and a corresponding first encrypted key, and decrypting the first encrypted key to recover a first key, without decrypting the first encrypted data. In one embodiment, the methods further include encrypting the first key using a second key to create a second encrypted key, wherein the second key is available only to the storage system, and storing the second encrypted key and the first encrypted data as received, without having to decrypt and re-encrypt the first encrypted data.