Encryption Key Recovery via Absolute Identifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in ensuring the availability and integrity of encryption keys, leading to data unavailability or loss due to key failures, improper key usage, or loss of proper decryption keys, which affects the reliability and security of encrypted data.
Innovation Solution
A method for encryption key recovery is implemented, where a storage object is created with an object identifier and a data encryption key, and a key identifier is stored in a key server. Upon detecting key failure, the key identifier is used to fetch a copy of the data encryption key from the key server, allowing the system to resume operations using the recovered key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored locally in the data storage system, then decryption operations can be performed quickly and independently, but the keys may become corrupted or lost leading to data unavailability
Solution Approach 1:
A key server is introduced as an intermediary component that centrally manages encryption keys. The key server stores backup copies of keys and provides key recovery services when local keys fail. This mediator resolves the contradiction by externalizing key management responsibilities, reducing local system complexity while improving reliability through centralized key protection and recovery capabilities.
Solution Approach 2:
Backup copies of encryption keys are pre-stored in the key server before any potential key failure occurs. When a local key becomes corrupted or lost, the system can immediately retrieve a replacement key from the key server without requiring complex recovery procedures. This preliminary preparation of backup keys resolves the contradiction by ensuring data availability while keeping the recovery process simple.
2Reliability
If encryption keys are stored externally in a key server, then key integrity and recovery are improved, but the system requires additional components and communication overhead
Solution Approach 1:
The key server acts as a dedicated intermediary component that handles key management externally. By separating key management functions from data storage operations, the system improves key integrity through centralized control and security measures while managing architecture complexity through a specialized, focused component rather than distributed complexity.
Solution Approach 2:
The key server provides self-service key recovery capabilities, automatically responding to key failure events without requiring manual intervention. When a local key fails, the data storage system automatically requests and retrieves replacement keys from the key server, reducing the need for complex manual key management procedures and specialized recovery protocols.
3Reliability
If key verification mechanisms are implemented, then improper key usage is prevented, but the data processing time increases
Solution Approach 1:
Key verification and validation are performed in advance when keys are initially loaded into the data storage system. The system checks key integrity and correctness before keys are used for encryption or decryption operations. This preliminary verification ensures key usage correctness while minimizing impact on data processing speed, as subsequent operations use already-validated keys without repeated verification overhead.
Data Source
AI summary
A data processing system stores encrypted data. Object identifiers are assigned to storage objects, and data encryption keys are assigned to the storage objects. When performing an operation upon a storage object, data encryption key failure may occur due to a corrupt or incorrect key. In this case, a copy of the data encryption key is fetched from a key server. It is possible for the association of the object identifiers with the data encryption keys to become lost or confused, so that the key server may fail to provide the correct key for a specified object identifier. Therefore, an absolute key identifier that is unique across the key server namespace also is stored in association with the object identifier in the storage system and in the key store of the key server, and the absolute key identifier is used as a failsafe for recovery of encrypted data.