Distributed Key Management for Secure Archival Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing scalable disk-based archival storage systems lack effective data privacy measures, particularly against unauthorized access and theft of stored data, as they do not inherently protect against recovery of encrypted content from stolen archive media.
Innovation Solution
Implementing a distributed key management solution based on a secret sharing protocol, where the encryption key is split and stored across multiple nodes, requiring a quorum of nodes to reconstruct and mount the drives, ensuring that the key is not written to disk and can only be accessed with the presence of a sufficient number of nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional RAIN storage architecture is used with replicated data on multiple nodes, then high availability and reliability are achieved, but data privacy and protection against unauthorized access are compromised
Solution Approach 1:
The encryption key is segmented into multiple shares using secret sharing protocols, with each share stored on different archive nodes. This segmentation ensures that no single node possesses the complete key, thereby protecting data privacy while maintaining the replicated storage architecture for high availability.
Solution Approach 2:
A key management service acts as an intermediary between data storage and decryption operations. This service coordinates key share distribution and reconstruction, enabling authorized access while preventing unauthorized nodes from decrypting data, thus resolving the contradiction between availability and security.
2Object-affected harmful factors
If encryption key is stored on archive nodes for transparent encryption, then data privacy is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The system implements self-service key management where archive nodes automatically participate in key share distribution and reconstruction processes without requiring external key management infrastructure. Nodes autonomously manage their key shares through the secret sharing protocol, reducing overall system complexity while maintaining strong security.
3Object-affected harmful factors
If secret sharing protocol is implemented to split encryption key across nodes, then data protection against stolen media is achieved, but access time increases due to quorum requirements
Solution Approach 1:
Key shares are pre-distributed to archive nodes during system initialization and stored in memory-ready formats. When data access is required, nodes already possess their key shares and can immediately participate in key reconstruction, eliminating the need for time-consuming key distribution during data access operations.
Data Source
AI summary
A storage cluster of symmetric nodes includes a data privacy scheme that implements key management through secret sharing. The protection scheme preferably is implemented at install time. At install, an encryption key is generated, split, and the constituent pieces written to respective archive nodes. The key is not written to a drive to ensure that it cannot be stolen. Due to the secret sharing, any t of the n nodes must be present before the cluster can mount the drives. To un-share the secret, a process runs before the cluster comes up. It contacts as many nodes as possible to attempt to reach a sufficient t value. Once it does, the process un-shares the secret and mounts the drives locally. Given bidirectional communication, this mount occurs more or less at the same time on all t nodes. Once the drives are mounted, the cluster can continue to boot as normal.