Cloud Storage Slice Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage systems face security issues due to the use of large encryption keys, where multiple files share the same key, compromising the security of large amounts of data if the key is compromised.
Innovation Solution
Implementing a method where each slice of a file is encrypted using a unique data key, with a key management system providing and managing these keys, and employing dynamic key buffering and streaming encryption/decryption to enhance security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple files share the same encryption key to simplify key management, then key management becomes easier, but data security is compromised because once the key is compromised, large amounts of data cannot be guaranteed secure
Solution Approach 1:
The patent segments the encryption key management at the slice level rather than file level. Each slice is encrypted with a unique data key, dividing the single key into multiple slice-level keys. This segmentation maintains security (compromise of one key only affects one slice) while the key management system manages multiple keys systematically through automated generation, storage, and rotation protocols
2Reliability
If each slice uses a different data key to improve security granularity, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent introduces a key management system as an intermediary between the cloud storage system and the encryption keys. This intermediary automatically generates data keys, manages their lifecycle (storage, rotation, revocation), and provides them to the cloud storage system. This mediates the complexity by centralizing key management functions and providing automated protocols, reducing the burden on the cloud storage system while maintaining slice-level security
Solution Approach 2:
The key management system implements self-service mechanisms by automatically generating data keys, rotating keys according to predefined policies, and managing key lifecycle without manual intervention. The system autonomously handles key generation, storage, distribution, and revocation, reducing operational complexity while maintaining high security standards through consistent automated processes
3Reliability
If data keys are frequently rotated to enhance security, then security is improved, but user request delays increase due to additional decryption/encryption operations
Solution Approach 1:
The patent implements preliminary action by pre-generating and buffering data keys in the key management system before they are needed for encryption or decryption operations. When a data access request occurs, the system can quickly retrieve pre-prepared keys without waiting for generation or complex cryptographic operations, significantly reducing user request delays while maintaining frequent key rotation for security
Solution Approach 2:
The patent implements dynamic key buffering where the key management system maintains a buffer of pre-generated data keys that can be quickly swapped. This dynamic approach allows the system to adapt to varying security requirements and request patterns, providing fast access when needed while maintaining the ability to rotate keys frequently for security without proportionally increasing delays
Data Source
AI summary
Some embodiments disclose a method and apparatus for processing data, a computer device and a storage medium. A method can include: acquiring, by a cloud storage system, a series of slices obtained by dividing a to-be-stored file; encrypting, by the cloud storage system, each slice by using a different data key; and storing, by the cloud storage system, an encrypted data ciphertext.