Cross-Encrypted Storage Key Segmentation for Secure Data Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage methods for portable devices, such as SSDs and memory cards, lack robust security mechanisms to prevent data misappropriation and loss, as password authentication can be cracked, and data is not recoverable if the device is lost or stolen.
Innovation Solution
A secured data storage and recovery method that encrypts data using a secured key and cross-encrypts it with a user password, storing the encrypted data, keys, and passwords on a remote device, allowing secure access and recovery even if the device is lost or damaged.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password authentication is used to protect data in storage devices, then data security is improved, but the password can be cracked and data is lost if the device is lost or stolen
Solution Approach 1:
The encryption key is segmented into two parts: a first key portion stored in the storage device and a second key portion stored remotely. Both portions are required to decrypt the encrypted data, preventing unauthorized access even if one portion is compromised. This directly addresses the vulnerability of single-password authentication by distributing security credentials across multiple locations.
Solution Approach 2:
A host computer acts as an intermediary to coordinate between the storage device and remote storage location. The host manages the encryption process, stores the second key portion remotely, and facilitates data recovery by retrieving both key portions. This intermediary enables secure cross-location key management without requiring direct communication between the storage device and remote storage.
2Reliability
If data is encrypted and stored locally in the storage device, then data security is improved, but data cannot be recovered if the device is lost or damaged
Solution Approach 1:
Different portions of the encryption key are stored in different locations with different security characteristics. The first key portion is stored locally in the storage device with hardware-based protection, while the second key portion is stored remotely with access control. This distributed key storage enables both security and recoverability by allowing data to be decrypted from multiple locations.
Solution Approach 2:
The data is pre-encrypted with a key that is split and stored in advance at different locations before any loss or damage occurs. The second key portion is stored remotely in advance, and recovery protocols are established beforehand. This preliminary preparation ensures that data can be recovered without requiring access to the original storage device after loss or damage.
3Ease of operation
If a secured area with password storage is implemented, then authentication capability is improved, but the password in the storage device can be read and cracked
Solution Approach 1:
The authentication key is segmented into two separate key portions stored in different locations. The first key portion is stored in the storage device's secured area, while the second key portion is stored remotely. Both portions are required for successful authentication and data decryption, making it infeasible to compromise the system by cracking a single password stored in the device.
Solution Approach 2:
Instead of storing the complete authentication key in one location, the system creates two separate copies of the key material (first and second key portions) and stores them in different locations. This copying approach ensures that neither copy alone is sufficient for authentication, thereby enhancing security while maintaining ease of operation through the host-mediated authentication process.
Data Source
AI summary
A method and a system of secured data storage and recovery are provided. First, a secured key and an encrypted user password of a storage device are obtained by using a controller of a storage device. Then, the secured key is encrypted by using the encrypted user password to generate a first private key, the encrypted user password is encrypted by using the secured key to generate a second private key, and data to be stored is encrypted by using the secured key. Finally, the encrypted data, the first private key, and the second private key are transmitted to a remote device for storage through a host. Thereby, the security of data storage is enhanced and data recovery mechanism is provided when the storage device is damaged or lost.