Data Cluster Encryption Key Derivation and Deletion

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data storage systems face inefficiencies in securing and managing data within data clusters, particularly in generating and managing encryption keys, which can lead to vulnerabilities in data access and resource utilization.

Innovation Solution

A method and system that involve a data cluster receiving a write request with an object identifier and user identifier, sending an intermediate key request to a key manager, processing data into chunks and metadata, generating an encryption key using the intermediate key, encrypting metadata, and deleting the encryption key after storage, thereby enhancing security and efficiency by minimizing key sharing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption keys are generated and stored in traditional data storage systems, then data security is provided, but key management complexity and vulnerability to key exposure increase

Engineering Contradiction:

Improvedata securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary key derivation mechanism where the encryption key is not directly stored but derived from an intermediate value computed from the stored data and a public key. This intermediary layer protects the actual encryption key from direct exposure while enabling secure data retrieval through the derivation process.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary key derivation setup by storing the intermediate value and public key in advance. When data retrieval is needed, the encryption key is freshly derived through computation rather than being directly accessed from storage, preventing key exposure while maintaining security.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If encryption keys are stored in data storage systems, then data can be encrypted and secured, but the risk of key exposure and unauthorized access increases

Engineering Contradiction:

Improvedata securityVSAvoidkey exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent uses an intermediary derivation process where the encryption key is computed from stored intermediate values rather than being directly stored. This intermediary mechanism ensures that even if stored data is compromised, the actual encryption key remains protected as it requires computation from multiple components.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The encryption key is treated as a temporary, disposable object that is freshly derived each time data is accessed and then discarded. This approach minimizes the window of vulnerability for key exposure since the key does not persist in storage but is generated on-demand and deleted after use.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If traditional key management methods are used in data clusters, then data encryption is enabled, but computational resources are consumed for key generation and management

Engineering Contradiction:

Improvedata encryption capabilityVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary setup by storing intermediate values and public keys during data ingestion. This shifts some computational burden to the ingestion phase, allowing faster and more resource-efficient data retrieval operations where the encryption key is derived from pre-stored components rather than generated from scratch each time.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11418326B2Method and system for performing secure data transactions in a data cluster

Publication Date: 2022.08.16 DELL PROD LP

AI summary

A method for securing data in a data cluster is performed by a data manager of a data cluster. The method includes receiving, by a data cluster, a write request for a user to write data to the data cluster, wherein the write request comprises an object identifier (OID) associated with data and a user identifier (UID) associated with the user; sending, to a key manager, an intermediate key request, wherein the intermediate key request comprises the UID; receiving, by the data cluster from the key manager, an intermediate key; processing the data to obtain a plurality of chunks and metadata associated with the plurality of chunks; generating an encryption key using the intermediate key and the OID; encrypting the metadata using the encryption key to generate encrypted metadata; deleting, after generating the encrypted metadata, the encryption key; and storing the encrypted metadata and the plurality of chunks in the data cluster.