Cloud Storage Key Sharing Without a Central Key Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for data encryption in cloud storage often rely on external key servers, which increase costs and complexity while lacking efficient methods for sharing encryption keys among multiple storage systems.
Innovation Solution
A key sharing network is established among storage systems, where each system generates its own data encryption keys and shares them securely, eliminating the need for a central key server, using a Public Key Infrastructure and secure communication protocols like TLS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a central key server is used to manage encryption keys, then key management is centralized and simplified, but system complexity and costs increase
Solution Approach 1:
The patent extracts the key management function from a centralized key server and distributes it to individual storage systems. Each storage system generates and manages its own encryption keys locally, eliminating the need for a central key server while maintaining secure key management capabilities.
Solution Approach 2:
The patent segments the centralized key management function into distributed key management units at each storage system. Instead of one central authority, multiple independent storage systems each handle their own key generation, storage, and management autonomously.
2Extent of automation
If a central key server is deployed, then key distribution is automated, but upfront and maintenance costs increase
Solution Approach 1:
Storage systems automatically generate and manage their own encryption keys without requiring a central key server. Each system performs self-service key management, including key generation, storage, and distribution to authorized systems, eliminating the need for expensive centralized infrastructure.
Solution Approach 2:
The patent combines key generation, key storage, and key management functions into the storage system itself. By merging these previously separate functions into a unified local system, organizations eliminate the need for dedicated key server infrastructure and reduce overall system costs.
3Adaptability or versatility
If encryption keys are shared among multiple storage systems, then data accessibility is improved, but security risks increase
Solution Approach 1:
The patent uses encrypted key wrappers as an intermediary mechanism. Instead of sharing plain text encryption keys directly between storage systems, keys are wrapped in encrypted form using each system's public key, allowing secure key exchange without compromising security or accessibility.
Solution Approach 2:
The patent employs asymmetric cryptography (public-key encryption) where each storage system has a public key for encryption and a private key for decryption. This asymmetric key pair system enables secure key sharing while maintaining strong security guarantees, as private keys never leave their originating systems.
Data Source
AI summary
A method for sharing data encryption keys among a plurality of storage systems is disclosed. The method generates, by a first storage system, a data encryption key for encrypting data sent from the first storage system to cloud storage. The method stores the encrypted data in the cloud storage in the form of an encrypted data object. In certain embodiments, the first storage system stores an Internet Protocol (IP) address of a second storage system belonging to a same key sharing network as the first storage system. The method replicates, from the first storage system to the second storage system, the data encryption key. The second storage system retrieves the encrypted data object from the cloud storage and decrypts the encrypted data in the encrypted data object using the data encryption key received from the first storage system.