Convergent Encryption Key Segregation for Storage De-duplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage systems face challenges in efficiently securing and storing data due to limitations in encryption techniques, particularly in performing content-based operations like de-duplication, as they generate different cipher text blocks for identical plain text blocks, making it difficult to de-crypt stored encrypted data containers, and existing convergent encryption systems are complex and costly.
Innovation Solution
The method involves generating a hash key by an I/O processing module to encrypt data blocks, using an encryption key to encrypt the hash key, and storing the cipher text with the encrypted hash key as metadata, allowing for efficient content-based operations such as de-duplication without requiring a dedicated metadata server, thus reducing complexity and cost.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption techniques are used to secure data, then data security is improved, but content-based operations like de-duplication cannot be performed efficiently
Solution Approach 1:
The encryption approach is segmented into two parts: a content-derived key (CDK) generated from data content using SHA-256 hash function, and a data encryption key (DEK) used for actual encryption. This segmentation allows the system to maintain security while enabling content-based operations through the deterministic nature of CDK generation.
Solution Approach 2:
A convergent key derivation mechanism acts as an intermediary between the data content and the encryption key. The CDK is derived deterministically from data content through SHA-256 hashing, serving as a mediator that enables both security and content-based operations like de-duplication without requiring dedicated metadata servers.
2Adaptability or versatility
If existing convergent encryption systems are used, then content-based operations are enabled, but system complexity and cost increase due to dedicated metadata servers
Solution Approach 1:
The system uses self-service by deriving encryption keys directly from data content through deterministic hash functions. Each data block generates its own CDK based on its content, eliminating the need for external metadata servers to manage key-generation relationships. The data itself serves as the source for its encryption key.
Solution Approach 2:
The SHA-256 hash function serves multiple functions: it generates the CDK for encryption, enables content-based de-duplication through deterministic hashing, and provides integrity verification. This multi-functionality eliminates the need for separate metadata management systems, reducing complexity while maintaining content-based operation capabilities.
3Reliability
If different cipher text blocks are generated for identical plain text blocks, then encryption security is maintained, but de-duplication operations become difficult
Solution Approach 1:
The system performs preliminary action by generating the CDK from data content before encryption occurs. This deterministic key derivation happens in advance, ensuring that identical content always produces the same encryption key and thus the same cipher text, enabling de-duplication while maintaining security through proper key management.
Solution Approach 2:
The encryption approach changes the parameter of key generation from random to deterministic. Instead of using random keys for each encryption operation, the system uses content-derived keys through SHA-256 hashing, transforming the key generation process to produce consistent results for identical content, thereby enabling de-duplication operations.
Data Source
AI summary
Methods and systems for securing information are provided. The method includes generating a hash key by an input/output (I/O) processing module interfacing with a processor executable application to encrypt a block of data of a data container to secure and store the data container; generating cipher text for the block of data encrypted with the hash key; using an encryption key to encrypt the hash key for the block of data; providing the cipher text and the encrypted hash key by the I/O processing module to a storage system for storage; where the I/O processing module segregates the encrypted hash key from the cipher text and maintains the encrypted hash key as part of metadata for the cipher text; and storing the cipher text with the encrypted hash key as the metadata for the cipher text for the block of data.