In-Place Data Re-Encryption via Region Shifting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing full volume encryption methods are inefficient in changing cryptographic keys without disrupting data access or compromising security, especially when keys are compromised or no longer secret.
Innovation Solution
The process of re-encrypting data by shifting it from an existing encryption region to a new region using a different cryptographic key, allowing for online or offline operations while maintaining data accessibility and fault tolerance through logging mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is re-encrypted by reading and writing to a different encryption region, then cryptographic key can be changed, but data access is disrupted and storage capacity is reduced due to region shifting
Solution Approach 1:
The patent segments the encryption process into chunks, processing data in manageable units. The encryption region is divided into multiple chunks that can be independently processed, allowing the system to maintain data accessibility while performing re-encryption operations on specific segments without disrupting the entire data set.
Solution Approach 2:
The patent implements preliminary actions by creating a mapping table before re-encryption begins. This mapping table stores the relationships between old and new encryption region addresses, enabling the system to redirect data access requests to the correct locations during and after the re-encryption process, thus maintaining data accessibility throughout the operation.
2Reliability
If encryption region is contracted and expanded during re-encryption, then new cryptographic key is applied, but storage capacity is temporarily reduced
Solution Approach 1:
The patent employs dynamic region management where the encryption region boundaries are adjusted during the re-encryption process. The region is contracted to exclude processed chunks and expanded to include new chunks, allowing flexible adaptation of storage space allocation as re-encryption progresses, thereby minimizing temporary storage capacity reduction.
Solution Approach 2:
The patent introduces a mapping table as an intermediary structure that mediates between the old and new encryption regions. This mapping table allows the system to maintain logical storage capacity by redirecting access requests from old region addresses to new region addresses, even though the physical encryption region boundaries are changing during re-encryption.
3Ease of operation
If re-encryption is performed online, then data remains accessible, but system complexity increases due to concurrent access management
Solution Approach 1:
The mapping table serves as an intermediary that simplifies concurrent access management during online re-encryption. By storing the relationships between old and new encryption region addresses, the mapping table allows the system to handle read and write requests to re-encrypted data without requiring complex real-time coordination mechanisms, thus reducing system complexity while maintaining data accessibility.
Solution Approach 2:
The patent implements feedback mechanisms where the system monitors the state of re-encryption progress and adjusts its behavior accordingly. The mapping table is updated as re-encryption progresses, providing feedback information that allows the system to optimize concurrent access patterns and manage system complexity efficiently during online operations.
Data Source
AI summary
The re-encryption of data can be performed with independent cryptographic agents that can automatically encrypt and decrypt data in accordance with cryptographic regions, such that data within a single cryptographic region is encrypted and decrypted with the same cryptographic key. An “in-place” re-encryption can be performed by reading data from a chunk in an existing cryptographic region, shrinking the existing cryptographic region past the chunk, expanding a replacement cryptographic region over the chunk, and then writing the data back to the same location, which is now part of the replacement cryptographic region. An “out-of-place” re-encryption can be performed by reading data from a chunk in an existing cryptographic region and then writing the data back to a location immediately adjacent that is part of a replacement cryptographic region. After the re-encrypted data is “shifted”, the cryptographic regions can be expanded and contracted appropriately, and another chunk can be selected.