Container Storage Encryption via External Key Manager
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multi-tenant environments face challenges in isolating storage resources between tenants, leading to potential exposure of private data, as administrators and malicious programs can access data across containers, compromising security.
Innovation Solution
Implementing a tenant-specific key manager external to the container host device, which provides encryption keys for an application file system security layer, ensuring that data is encrypted and decrypted independently of the container host, thus isolating private data and maintaining access security across different hosts and storage platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If storage resources are shared among multiple tenants in a multi-tenant environment, then resource utilization efficiency is improved, but data isolation and security are worsened
Solution Approach 1:
The patent segments storage resources into tenant-specific storage volumes, where each tenant has isolated storage space. This is achieved through virtualization techniques that create logical separation of storage resources while maintaining physical consolidation, thus improving both resource utilization and data isolation.
Solution Approach 2:
The patent introduces a storage virtualization layer as an intermediary between tenants and physical storage resources. This layer implements access control policies, encryption, and isolation mechanisms that prevent tenants from accessing each other's data while allowing efficient resource sharing through the virtualized interface.
2Ease of operation
If administrators have access to container data for management purposes, then system control is improved, but data security is worsened
Solution Approach 1:
The patent implements local quality by applying different access control levels to different administrators based on their roles and responsibilities. Critical security-related data remains inaccessible even to administrators, while non-critical operational data is accessible for management purposes. This selective access control maintains both system controllability and data security.
Solution Approach 2:
The patent applies preliminary anti-action by implementing encryption and access control policies before administrators can access any container data. Encryption keys are separately managed and never exposed to administrators, preventing any potential unauthorized access while still allowing necessary administrative operations through controlled interfaces.
3Speed
If encryption keys are stored within containers for easy access, then decryption speed is improved, but security is worsened
Solution Approach 1:
The patent extracts encryption key management from container storage and implements it as a separate, secure key management service. The actual encryption keys never reside within container filesystems, eliminating the security vulnerability. Decryption performance is maintained through optimized key retrieval mechanisms from the external key management service.
Solution Approach 2:
The patent implements preliminary action by pre-loading encryption keys into the key management service and establishing secure caching mechanisms. This allows rapid key retrieval for decryption operations without requiring keys to be stored within containers, thus achieving both fast decryption speeds and enhanced security through centralized key management.
Data Source
AI summary
An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment. The containers are configured to utilize storage resources of at least one storage platform. A given one of the containers comprises at least one application, and an application file system security layer configured to communicate with the storage platform. The application file system security layer comprises a container storage volume supported by the storage platform, and an encryption engine configured to encrypt and decrypt data of the container storage volume utilizing one or more data encryption keys that are encrypted under a tenant-specific key encryption key. The tenant-specific key encryption key is provided to the application file system security layer by a tenant key manager that is external to the container. The tenant key manager is illustratively controlled by the tenant for which the given container is implemented.