Encrypted Chunks Map for Rapid Data Encryption Policy Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face delays and user frustration due to the time-consuming process of encrypting entire storage volumes to comply with corporate data access policies, which can take several minutes or hours, before allowing access to corporate services.
Innovation Solution
Implementing a sector map or encrypted chunks map to identify and manage encryption of sectors or chunks within a storage volume, allowing for rapid compliance by encrypting only newly written data and decrypting as necessary, without requiring the entire volume to be encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire storage volume is encrypted to comply with corporate data access policies, then security compliance is achieved, but access time to corporate services is significantly delayed (several minutes to hours)
Solution Approach 1:
The patent divides the storage volume into multiple chunks and implements selective encryption at the chunk level rather than encrypting the entire volume. This segmentation allows the system to encrypt only the necessary portions of data while maintaining fast access to unencrypted chunks, thereby achieving policy compliance without significant access delays.
Solution Approach 2:
The patent implements partial encryption by encrypting only specific chunks of the storage volume that contain sensitive corporate data, rather than encrypting the entire volume. This partial action approach maintains security compliance for protected data while leaving other data accessible without encryption overhead, thus reducing access time.
2Reliability
If the entire storage volume is encrypted to ensure data security, then security is improved, but the complexity of managing encryption state increases
Solution Approach 1:
The patent uses a chunk map data structure that divides the storage volume into manageable chunks, tracking the encryption state of each chunk independently. This segmentation simplifies management by allowing the system to track and manage encryption state at the chunk level rather than dealing with the complexity of entire volume encryption, reducing the burden on the file system.
Solution Approach 2:
The patent introduces a chunk map as an intermediary data structure between the file system and the storage volume. This chunk map tracks the encryption state of each chunk and mediates between encryption operations and file system operations, simplifying the management of encryption state by providing a centralized tracking mechanism that the file system can query without directly managing complex encryption protocols.
3Speed
If selective chunk encryption is implemented instead of full volume encryption, then access speed is improved, but the complexity of tracking encrypted sectors increases
Solution Approach 1:
The patent segments the storage volume into fixed-size chunks and implements a chunk map that tracks encryption state at this granular level. This segmentation approach balances tracking complexity by using a regular, predictable structure (fixed-size chunks with sequential numbering) rather than tracking individual sectors, thereby reducing the overall complexity while enabling fast access to unencrypted data.
Solution Approach 2:
The patent uses a uniform chunk structure throughout the storage volume, where each chunk has the same fixed size and follows a consistent numbering scheme. This homogeneity simplifies tracking by allowing the chunk map to use a predictable, regular pattern for storing and retrieving encryption state information, reducing the complexity compared to irregular sector-based tracking.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To comply with a policy for a computing device indicating that data written by the computing device to the storage volume after activation of the policy be encrypted, an encrypted chunks map is accessed. The encrypted chunks map identifies whether, for each chunk of sectors of a storage volume, the sectors in the chunk are unencrypted. In response to a request to write content to a sector, the encrypted chunks map is checked to determine whether a chunk that includes the sector is unencrypted. If the chunk that includes the sector is unencrypted, then the sectors in the chunk are encrypted, and the content is encrypted and written to the sector. If the chunk that includes the sector is encrypted or not in use, then the content is encrypted and written to the sector.