Dynamic Encrypted Storage Allocation for Containers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current containerized environments lack dynamic and elastic storage allocation mechanisms that allow containers to specify storage needs on-demand, and existing encrypted storage solutions do not provide dedicated encrypted storage for individual containers, leading to inefficiencies and security vulnerabilities.

Innovation Solution

A dynamic encrypted storage system that allows containers to request and allocate encrypted storage volumes of specific sizes by leveraging a storage configuration manager, dynamic encrypted volume manager, and key management infrastructure, ensuring only authorized containers access the encrypted storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If static storage allocation is used for containers, then storage management is simple, but containers cannot dynamically specify the amount of storage needed

Engineering Contradiction:

Improvedynamic storage allocationVSAvoidstorage management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements dynamic storage allocation by allowing storage volumes to be created and resized on-demand based on container requirements. The system transitions from static pre-allocation to dynamic provisioning where storage capacity can be adjusted during runtime to match actual usage patterns, enabling containers to specify their storage needs without manual intervention.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent introduces a storage management intermediary layer that sits between the underlying storage infrastructure and container applications. This intermediary handles the complexity of dynamic allocation, volume creation, and resource orchestration, shielding containers from storage system complexity while enabling flexible storage specification through standardized interfaces.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If shared encrypted storage is used, then storage utilization is improved, but security is compromised as all containers can access the encrypted volume

Engineering Contradiction:

Improvedata securityVSAvoidstorage utilization

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments encrypted storage into container-specific encrypted volumes, where each container receives dedicated encrypted storage space. This segmentation ensures that encryption keys and access permissions are isolated per container, preventing cross-container access while maintaining high storage utilization through efficient space management and allocation mechanisms.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by providing customized encryption and access control for each container's storage volume. Each encrypted volume has its own security parameters, key management, and access policies tailored to the specific container's requirements, enabling both high security and efficient storage utilization through localized security enforcement.

Inventive Principle:

Principle #3Local quality

3Productivity

If manual storage allocation is used, then storage distribution is controlled, but operational efficiency decreases due to manual intervention

Engineering Contradiction:

Improveoperational efficiencyVSAvoidstorage allocation simplicity

Core Design Contradiction:

ProductivityVSEase of operation

Solution Approach 1:

The patent implements self-service storage allocation where containers can automatically request and receive storage volumes based on their declared requirements. The system autonomously handles volume creation, provisioning, and assignment without manual operator intervention, dramatically improving operational efficiency while maintaining controlled storage distribution through policy-based resource management.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent applies preliminary action by pre-configuring storage policies, capacity limits, and allocation rules before containers are deployed. This upfront configuration enables automated, efficient storage allocation at runtime while maintaining controlled distribution, as the system already has the necessary parameters and constraints defined to make intelligent allocation decisions without manual intervention.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11340797B2Dedicated encrypted container storage

Publication Date: 2022.05.24 TPK INVESTMENTS LLC

AI summary

Techniques are disclosed for dynamically allocating dedicated encrypted storage for containers/applications in a containerized environment. Only those container(s) are able to access an encrypted storage volume that have access to the volume secret for the volume. The volume secret is combined with a pre-key using a hash-based key derivation function (HKDF) to obtain the volume/encryption key for the volume. In various aspects, one is able to specify the amount of encrypted storage desired/required in a storage/host volume to be allocated to a container on-demand. The containerized application for which an instant dynamically allocated dedicated storage volume is created may be a composable multi-container or microservices application. The encrypted storage volume is optimally assembled from the partitions of the storage devices available on a host. The storage devices may be local to the host or remote or in the cloud.