Encryption by Default in Elastic Computing Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing, existing techniques for creating new volumes from unencrypted snapshots fail to ensure data encryption, leading to non-compliance with changing data protection regulations and potential data security breaches by sharing encryption information with hardware.
Innovation Solution
Implementing a custom volume modification technique that enables encryption-by-default, using a dedicated hardware pool to encrypt volumes in real-time during the creation process from unencrypted snapshots, with users having control over encryption keys and permissions, and employing AES-256 encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing techniques are used to create new volumes from unencrypted snapshots, then the process is simple and fast, but data encryption is not ensured and compliance with data protection regulations is compromised
Solution Approach 1:
The system performs encryption preparation in advance by obtaining an encryption key from a hardware security module before the volume creation process. The encryption key is ready beforehand, allowing the volume to be encrypted during the creation process itself, ensuring encryption assurance without adding complex post-encryption steps.
Solution Approach 2:
A hardware security module serves as an intermediary between the volume creation process and encryption operations. This dedicated hardware component manages the encryption keys and performs encryption functions, isolating the complexity of encryption from the main volume creation workflow while ensuring reliable data protection.
2Reliability
If encryption is implemented during volume creation, then data security is improved, but the creation process time increases
Solution Approach 1:
The encryption key is obtained from the hardware security module before the volume creation process starts. This preliminary preparation ensures that when the volume is being created, the encryption operation can proceed immediately without delays, minimizing the time added by encryption while maintaining strong data security.
Solution Approach 2:
The encryption operation is merged with the volume creation process itself rather than being a separate subsequent step. The volume is created and encrypted in a single integrated operation, where the encryption key is applied during the creation process, reducing overall time compared to sequential approaches.
3Ease of manufacture
If encryption information is shared with hardware, then encryption can be performed, but data security is compromised due to potential breaches
Solution Approach 1:
The hardware security module acts as a secure intermediary that holds and manages encryption keys. This dedicated hardware component provides a secure environment for key storage and encryption operations, preventing direct exposure of encryption information to the main hardware system and reducing the risk of data breaches.
Solution Approach 2:
The encryption functionality is segmented into a separate hardware security module rather than being integrated into the main hardware system. This segmentation isolates the encryption keys and encryption operations from the rest of the hardware, creating security boundaries that prevent unauthorized access and potential breaches.
4Reliability
If users have control over encryption keys, then data protection compliance is improved, but system complexity increases
Solution Approach 1:
The hardware security module provides self-service encryption key management functionality. Users can obtain encryption keys and control their own data protection through the hardware module without requiring complex key management systems. The hardware module handles key generation, storage, and management automatically, maintaining user control while reducing system complexity.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.