Encrypted File System Revocation via Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing electronically stored information are inadequate in preventing access by revoked system administrators and ensuring the secure erasure of encryption keys, particularly due to the replication of electronic information and the potential for inappropriate access by a quorum of users.
Innovation Solution
A method involving encrypting target electronically stored information with a first encryption key, partitioning it into sets that can be reconstructed by a predetermined number of partitions, and then re-encrypting with a second key when access privileges change, ensuring that the first key is forgotten to render back copies useless.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a quorum of system administrators is used to access secured information, then data security is improved through distributed key management, but the risk of inappropriate access increases when revoked administrators retain their keys
Solution Approach 1:
The system dynamically updates encryption keys for the electronically stored information when access privileges change. When a system administrator is revoked, the key management component generates a new encryption key and re-encrypts the data, ensuring that revoked administrators can no longer access the information with their previous keys.
Solution Approach 2:
The system proactively manages key lifecycle including generation, distribution, and revocation before security incidents occur. The key management component is configured to automatically update encryption keys when access privilege changes are detected, preventing revoked administrators from accessing data rather than reacting after a security breach.
2Ease of operation
If encryption keys are distributed among multiple administrators, then access control is improved through quorum requirements, but key security deteriorates due to increased exposure risk
Solution Approach 1:
The system changes the encryption key parameter when access privileges change. By updating the encryption key associated with the electronically stored information, the system ensures that even though multiple administrators may have had access previously, only currently authorized administrators can access the data with the new key.
Solution Approach 2:
The key management component acts as an intermediary between administrators and the electronically stored information. It controls key distribution, updates, and revocation, mediating access requests and ensuring that only authorized administrators receive the necessary decryption keys, thereby reducing direct exposure risk.
3Productivity
If electronic information is highly replicated for availability, then system reliability is improved, but security deteriorates because erasing all copies becomes nearly impossible
Solution Approach 1:
Instead of attempting to physically erase all replicated copies of the electronically stored information, the system changes the encryption key parameter. When a key is revoked and new data is encrypted with a new key, the old encrypted copies become mathematically inaccessible, achieving secure erasure效果 without needing to locate and delete all physical copies.
Solution Approach 2:
The system extracts the security vulnerability from the replication problem by separating the data from its encryption key. By updating the encryption key independently of the data replicas, the system renders all existing copies insecure without needing to track or destroy them, effectively taking out the security risk from the replication architecture.
Data Source
AI summary
A method of securely storing electronic information includes a step in which target electronically stored information is encrypted with a first encryption key and then partitioned into a first set of encrypted ESI partitions a subset of which is able to reconstruct the unpartitioned encrypted ESI. This first set of encrypted ESI partitions is then encrypted with a first set of user encryption keys to form a first set of user-associated encrypted ESI partitions that are made available to a first set of users. When access to the target electronically stored information is changed, the target electronically stored information is accessed and then re-encrypted with a second encryption key to form a second encrypted ESI. This second encrypted ESI is then partitioned and distributed to a second set of users.