Encrypted Storage Block Movement via Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face vulnerabilities when moving encrypted data, as encryption based on hardware location can render data inaccessible during movement, and providing decryption access to hypervisors poses security risks.
Innovation Solution
Implementing a method where storage management features, such as a hypervisor, can move encrypted storage blocks by decrypting using a location-dependent key and re-encrypting with a location-independent key, keeping the data encrypted throughout the process, thus maintaining security and accessibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using location-dependent keys in storage devices, then security against unauthorized access is improved, but data becomes inaccessible when moved to different locations
Solution Approach 1:
The encryption key is segmented into two parts: a location-dependent key for storage security and a location-independent key for data movement. This segmentation allows the system to maintain both security during storage and mobility during transfer, resolving the contradiction between these two requirements.
Solution Approach 2:
A hypervisor acts as an intermediary that manages the encryption key transitions. It coordinates the decryption using location-dependent keys and re-encryption with location-independent keys during data movement, enabling secure data migration without exposing plaintext data.
2Adaptability or versatility
If hypervisor is provided with decryption access to move encrypted data, then data movement capability is improved, but security vulnerability increases if hypervisor is compromised
Solution Approach 1:
The decryption capability is extracted from the hypervisor and implemented in the storage device itself. The storage device autonomously performs decryption and re-encryption operations using location-dependent and location-independent keys, eliminating the need for hypervisor decryption access and thus removing the security vulnerability.
Solution Approach 2:
The storage device provides self-service encryption and decryption functionality. It automatically manages key transitions during data movement without requiring external decryption assistance from the hypervisor, maintaining security while enabling data mobility.
3Ease of operation
If data remains unencrypted in main memory for accessibility, then ease of access is improved, but vulnerability to snooping by unauthorized code increases
Solution Approach 1:
Different encryption approaches are applied to different locations: location-dependent encryption is used in storage devices for security, while location-independent encryption is used in main memory for accessibility. This local quality differentiation allows the system to optimize for security in storage and accessibility in memory without compromising either requirement.
Data Source
AI summary
Systems and methods for moving encrypted storage blocks in a security enhanced manner. An example method may comprise: selecting, by a processing device, a storage block stored by a storage device, wherein the storage block comprises encrypted content and is associated with a computing process; causing the encrypted content of the storage block to be decrypted using a first cryptographic input that is location dependent and encrypted using a second cryptographic input that is location independent; and copying the storage block comprising the encrypted content from a first location within the storage device to a second location within the storage device.