Copy-on-encrypt Buffer Caches for Secure Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage systems face challenges in encrypting data before it is written to disk, leading to performance degradation due to the need for plaintext data during cache operations and inadequate protection against unauthorized access.
Innovation Solution
The implementation of 'copy-on-encrypt' method, where plaintext data is copied to an encryption buffer, encrypted, and then written to an encrypted storage resource, allowing the original plaintext buffer to remain accessible for cache operations without compromising performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted in the cache before writing to disk, then data protection is improved, but cache read performance deteriorates because the plaintext version is destroyed
Solution Approach 1:
The cache is segmented into two distinct buffer types: plaintext buffers for caching unencrypted data and encryption buffers for caching encrypted data. This segmentation allows the system to maintain both plaintext and encrypted versions of data in separate locations, enabling cache reads to access plaintext data while plaintext is being encrypted and written to disk, thus resolving the contradiction between data protection and cache read performance
Solution Approach 2:
An intermediary mechanism is introduced where the system maintains a reference count for each buffer. When plaintext data is copied to an encryption buffer for encryption, the plaintext buffer's reference count prevents its destruction until the encryption process completes. This intermediary reference counting system allows both plaintext caching and encryption operations to coexist without compromising either data protection or cache performance
2Speed
If plaintext data is written to disk, then cache operation speed is improved, but security deteriorates because unauthorized access can occur
Solution Approach 1:
The system performs preliminary encryption of data in the encryption buffer before writing to disk. By completing the encryption process in advance and only then writing the encrypted data to disk, the system ensures that no plaintext data is ever stored on disk, eliminating the security vulnerability while maintaining cache operation speed through efficient buffer management
3Reliability
If encryption is performed before writing to disk, then data security is improved, but system complexity increases due to additional buffer management
Solution Approach 1:
The system changes the state parameter of buffers by maintaining a reference count that tracks whether a buffer is currently being encrypted. This parameter change allows the same buffer infrastructure to serve dual purposes: caching plaintext data and performing encryption operations, thereby reducing overall system complexity compared to maintaining completely separate buffer systems
Data Source
AI summary
Encryption using copy-on-encrypt determines that plaintext data stored in a plaintext buffer is to be written out to an encrypted storage resource. In response to the determining, an encryption buffer is allocated. The plaintext data is copied from the plaintext buffer to the encryption buffer and the encryption buffer is encrypted. Encrypted data from the encryption buffer is written to the encrypted storage resource. The encryption buffer is de-allocated. Read or write requests from a client are satisfied by retrieving the plaintext data from the plaintext buffer.