Dynamic Cached-Data Encryption With Active-Tier Key Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data deduplication storage systems, such as Dell EMC Data Domain, do not support key-based encryption and decryption of cached data and metadata, leading to onerous key management and processing overheads, and require key management systems that are agnostic to key-state and key-type.
Innovation Solution
A cryptographic key management scheme that abstracts key management from the cache layer, using a dedicated cryptographic key management module to handle key rotation and transitions across multiple storage layers, ensuring secure encryption and decryption of cached data without requiring the cache layer to manage cryptographic artifacts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the cache layer manages cryptographic artifacts and key management, then data security is improved, but device complexity and processing overhead increase significantly
Solution Approach 1:
The system segments key management responsibilities by introducing a dedicated cryptographic key manager component that handles all cryptographic artifacts separately from the cache layer. The cache layer only stores key identifiers while the key manager manages actual keys, key rotation, and key lifecycle events independently.
Solution Approach 2:
A cryptographic key manager acts as an intermediary between the cache layer and cryptographic operations. This mediator handles key generation, storage, rotation, and destruction, allowing the cache layer to focus on data caching while security operations are delegated to the specialized key manager component.
2Reliability
If the cache layer manages cryptographic artifacts, then encryption capability is improved, but processing overhead and productivity decrease
Solution Approach 1:
The cryptographic key manager operates autonomously to manage all cryptographic artifacts without requiring cache layer intervention. It self-manages key generation, storage, rotation schedules, and destruction, reducing the processing burden on the cache layer while maintaining encryption capabilities.
Solution Approach 2:
The key manager serves as an intermediary that handles time-consuming cryptographic operations separately, allowing the cache layer to process data caching operations at full speed without being bottlenecked by key management overhead.
3Reliability
If key management is integrated into the cache layer, then data protection is improved, but cache efficiency and adaptability decrease
Solution Approach 1:
The system separates data caching functions from cryptographic key management functions. The cache layer handles data storage and retrieval efficiently while the dedicated key manager handles cryptographic operations, allowing each component to optimize its specific function without compromise.
Solution Approach 2:
The key manager intermediary enables the cache layer to remain agnostic of cryptographic details, maintaining high cache efficiency while still providing robust data protection through the specialized key management component that handles all cryptographic artifacts.
Data Source
AI summary
Embodiments of a cryptographic key management system for cached data that abstracts key management details from the cache tier to the active tier and encryption process by encrypting data from the active tier using an encryption process employing an encryption key to generate an encrypted data block, and associating an encryption header with the encrypted data block, the encryption header including a key identifier as an index to the encryption key, where the encryption key is accessed through a key table maintained in the active tier. The system stores the encrypted data block in a cache tier, and decrypts the encrypted data block in the cache tier by providing the key identifier in the encryption header to the encryption process.