Encrypted Storage Replication with Secure Key Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in maintaining encryption during data replication, particularly in distributed environments, leading to potential security vulnerabilities and data integrity issues.
Innovation Solution
Implementing end-to-end encryption methods that utilize inferred trust mechanisms to secure data replication processes, ensuring encryption is maintained across multiple storage nodes and systems, even in asynchronous replication scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is replicated across multiple storage nodes in distributed environments, then data availability and redundancy are improved, but security vulnerabilities and data integrity issues arise due to encryption maintenance challenges
Solution Approach 1:
The patent segments the encryption key management into separate components: master encryption keys remain at the source storage system, while data encryption keys are distributed to replica storage systems. This segmentation allows each node to have the necessary encryption capabilities without exposing all keys, thus maintaining security while enabling replication.
Solution Approach 2:
The patent introduces an intermediary key encapsulation mechanism where a key encapsulation key pairs (KCK_P, KMS_P) act as mediators between the source and replica storage systems. This intermediary layer enables secure key distribution and verification without directly exposing master encryption keys, resolving the contradiction between security and replication.
2Object-affected harmful factors
If encryption is maintained during data replication, then data confidentiality is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent performs preliminary key setup actions during initialization: generating key encapsulation key pairs, establishing key derivation functions, and pre-configuring verification mechanisms. This preliminary action reduces operational complexity during actual replication by having the cryptographic framework already in place.
Solution Approach 2:
The patent changes the cryptographic parameters from simple master keys to a more complex but manageable key encapsulation structure with multiple key components (KCK_P, KMS_P, KEK). This parameter change enables automated key management through mathematical relationships between keys, reducing manual intervention complexity.
3Ease of manufacture
If traditional encryption methods are used during replication, then implementation simplicity is improved, but data integrity issues arise in asynchronous replication scenarios
Solution Approach 1:
The patent implements feedback mechanisms through verification data that travels with replicated data blocks. The replica storage system uses this verification data to validate data integrity upon receipt, creating a feedback loop that confirms successful and accurate replication without requiring complex retransmission protocols.
Solution Approach 2:
The patent performs preliminary calculation of verification data (such as hashes or checksums) before replication, and sends this verification data along with the data blocks. This preliminary action enables the receiving system to immediately verify integrity without complex post-replication analysis, maintaining both simplicity and reliability.
Data Source
AI summary
Creating a replica of a storage system, including: receiving, by a first storage system from a computing device, data to be stored on the first storage system; reducing, by the first storage system, the data using one or more data reduction techniques; sending, from the first storage system to the second storage system, the reduced data, wherein the reduced data is encrypted; and sending, from the second storage system to a third storage system, the reduced data, wherein the reduced data is encrypted.