Immutable Data Safe for Secure Key Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for managing security risks on the Worldwide Web/Public Internet are inadequate, leading to significant economic losses and data breaches, as evident from recent cyber-attacks on critical infrastructure and personal information theft.
Innovation Solution
An immutable 'data safe' is implemented to secure data at rest by encrypting and decrypting information using cryptographic pilot keys stored within the data safe, providing additional layers of protection through feature-preserving encryption and maintaining data structure instances in a way that prevents unauthorized access or decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data is stored in external storage systems, then data accessibility and storage capacity are improved, but data security and protection against breaches deteriorate
Solution Approach 1:
The system segments data protection by separating encryption keys (pilot keys) from encrypted data. The data safe contains pilot keys that are never exposed outside, while encrypted data can be stored in external storage systems. This segmentation allows data to be stored externally for accessibility while maintaining security through key isolation.
Solution Approach 2:
The data safe acts as an intermediary between encrypted data in external storage and the pilot keys needed for decryption. It provides a secure interface that allows data to be stored externally while maintaining security control, enabling both high storage capacity and data protection.
2Ease of operation
If cryptographic keys are exposed for data decryption, then data accessibility is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system extracts the most critical security element (pilot keys) and removes it from external exposure. The data safe isolates pilot keys internally, extracting only the encrypted data for external storage and processing. This allows data accessibility while eliminating the exposure risk of keys.
Solution Approach 2:
The system adds a dimensional layer of security by creating a separate security boundary (the data safe) that contains pilot keys. This dimensional separation allows data to be accessed externally while keys remain in a protected internal dimension, resolving the conflict between accessibility and security.
3Reliability
If full encryption keys are used for data protection, then security is improved, but computational complexity and processing overhead increase
Solution Approach 1:
The encryption system is segmented into multiple layers: pilot keys stored securely in the data safe, and data cryptographic keys used for actual encryption/decryption operations. This segmentation allows strong security through layered encryption while reducing computational complexity by using smaller, more efficient data cryptographic keys for processing.
Solution Approach 2:
Data cryptographic keys act as intermediaries between pilot keys and encrypted data. The pilot keys securely generate and protect the data cryptographic keys, which then handle the actual encryption/decryption operations. This intermediary layer reduces computational complexity while maintaining security through the pilot key protection mechanism.
Data Source
AI summary
In one embodiment, data at rest is securely stored. A data safe performing data plane processing operations in response to requests of received read data requests, received write data requests, and received read information responses, with the data safe being immutable to processing-related modifications resulting from said performing data plane processing operations. Performing these data plane processing operations does not expose any pilot keys outside the data safe in plaintext form nor in encrypted form. The pilot keys are used to encrypt information that is subsequently stored in a storage system. In one embodiment, the information encrypted and decrypted by the data safe includes data structure instances including feature-preserving encrypted entries generated using feature-preserving encryption on corresponding plaintext data items. In one embodiment, a data vault performs queries on the data structure instances including feature-preserving encrypted entries after retrieval from storage and decryption by the data safe.