Credential Storage Encryption in Data Security Mechanisms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data storage systems lack secure mechanisms for storing credentials such as usernames and passwords, and other configuration data, which are essential for secure access and fault tolerance, especially as system components are replaced over time.
Innovation Solution
A method is introduced to securely store credentials within a data security mechanism of a data storage system by using a unique identifier and a set of stable values to encrypt and decrypt credentials, with storage located among critical devices like disk drives and storage processor modules, ensuring secure access even during component replacements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are stored in plain text for easy access, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent transforms credentials from plain text to encrypted form, changing the state parameter of the data. Encryption algorithms convert readable credentials into unreadable ciphertext, which can only be decrypted with the correct key, thus maintaining security while enabling authorized access.
Solution Approach 2:
The patent introduces an intermediary encryption/decryption mechanism between the credential storage and access points. This intermediary layer ensures that even if credentials are intercepted or accessed unauthorizedly, they remain encrypted and unusable without proper authentication.
2Speed
If credentials are stored in volatile memory for fast access, then speed is improved, but reliability is worsened
Solution Approach 1:
The patent segments credential storage into multiple locations: encrypted credentials are stored in persistent storage (disk), while decryption keys or authentication data may be stored in volatile memory (RAM). This segmentation allows fast access through memory while maintaining reliability through persistent encrypted storage.
Solution Approach 2:
The patent performs preliminary encryption of credentials before storage, and pre-positions decryption keys in memory when needed. By preparing encrypted credential data in advance and having decryption mechanisms ready in volatile memory, the system achieves both fast access and reliable persistence.
3Ease of operation
If credentials are stored in centralized location for easy management, then ease of operation is improved, but vulnerability to single point of failure is worsened
Solution Approach 1:
The patent segments credential storage across multiple storage devices or locations within the storage array. Instead of storing all credentials in a single centralized location, different credential sets or portions are distributed across multiple physical or logical storage units, providing fault tolerance while maintaining manageable access through the encryption framework.
4Object-affected harmful factors
If encryption is applied to all data for security, then security is improved, but processing overhead is worsened
Solution Approach 1:
The patent applies encryption selectively rather than uniformly to all data. Credentials are encrypted with appropriate security measures, while other non-sensitive data may use simpler storage methods. This local quality approach applies stronger security only where needed, reducing overall processing overhead while maintaining necessary security protections.
Data Source
AI summary
A technique provides secure access to a set of credentials within a data storage system. The technique involves obtaining a unique identifier (e.g., a hostname which is unique to the system) and a set of stable values (e.g., machine-generated codes which are random to users of the system); and, in response to a storage request from a client application, storing a set of credentials of the client application within a data security mechanism of the data storage system. The set of credentials is in encrypted form when stored within the data security mechanism of the data storage system. The technique further involves configuring the data security mechanism of the data storage system to provide the set of credentials in non-encrypted form in response to new fingerprints matching a system fingerprint which is formed at least in part from the unique identifier and the set of stable values.