Copy-on-Write File System Secure Data Deletion via Key Alteration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In copy-on-write file systems, securely deleting data sets is challenging due to the complexity of pooled storage systems, where data may be offline, and overwriting or scrubbing all data is time-consuming and inefficient.
Innovation Solution
Generating and managing encryption keys to create an encrypted data set, wrapping the key with an administrative key, and altering the key to make the data set inaccessible upon deletion, ensuring secure and efficient data removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is deleted from pooled storage systems by overwriting or scrubbing, then data security is improved, but time consumption and system complexity increase significantly
Solution Approach 1:
The patent applies preliminary action by encrypting data with a dataset key before storage, and pre-wrapping the dataset key with an administrative key. This preliminary cryptographic preparation enables instant secure deletion through key alteration rather than time-consuming data overwriting, resolving the contradiction between data security and time consumption.
Solution Approach 2:
The patent replaces the mechanical process of overwriting or scrubbing physical storage media with a cryptographic key alteration mechanism. By changing the administrative key that wraps the dataset key, the system achieves secure deletion through cryptographic means rather than physical data destruction, dramatically reducing time consumption while maintaining security.
2Reliability
If all data in pooled storage is overwritten to ensure secure deletion, then data security is improved, but system complexity and operational difficulty increase
Solution Approach 1:
The patent segments the deletion process into key management operations rather than data-level operations. By separating the dataset key from the encrypted data and the administrative key from the dataset key, the system achieves secure deletion through hierarchical key alteration, simplifying the overall system complexity compared to comprehensive data overwriting.
Solution Approach 2:
The patent introduces cryptographic keys as intermediaries between the administrative system and the encrypted data. The administrative key wraps the dataset key, which in turn encrypts the actual data. This intermediary key hierarchy enables secure deletion through key alteration without requiring complex data tracking and overwriting operations across the pooled storage system.
3Reliability
If encryption keys are managed for each data set, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent applies the nested doll principle by having the administrative key wrap the dataset key, which itself wraps the encrypted data. This nested cryptographic structure allows hierarchical key management where a single administrative key can control access to multiple dataset keys, reducing key management complexity while maintaining strong security through multiple encryption layers.
Data Source
AI summary
Information in a data set of a copy-on-write file system may be made inaccessible. A first key for encrypting a data set of a copy-on-write file system is generated and wrapped with a second key. An encrypted data set is created with the first key. The wrapped first key is stored with the encrypted data set. A command to delete the encrypted data set is received and the second key is altered or changed to make information in the encrypted data set of the copy-on-write file system inaccessible.