Encryption Packet Key Rotation for Storage Area Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security methods in storage area networks require frequent re-encryption of large datasets, which is cumbersome and inefficient, and risk data loss if the encryption device fails.
Innovation Solution
A method and system that generate a first encryption key for data, a second encryption key to secure the first key, and create an encryption packet including both keys and data, which is stored and periodically refreshed, eliminating the need for frequent re-encryption of the entire dataset and ensuring data security even if the encryption device fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using traditional methods with periodic re-encryption, then data security is improved, but network performance deteriorates due to the cumulative overhead of repeatedly encrypting large datasets
Solution Approach 1:
The encryption process is segmented into two distinct phases: an initial encryption phase that encrypts the entire dataset, and a subsequent key rotation phase that only regenerates encryption keys without re-encrypting data. This segmentation eliminates the performance penalty of periodic full data re-encryption while maintaining security through key regeneration.
Solution Approach 2:
The system performs preliminary encryption of the entire dataset once, storing both the encrypted data and the encryption keys. Subsequent security enhancements only require regenerating keys, which are stored separately from the encrypted data. This preliminary action avoids the need for repeated full re-encryption operations.
2Reliability
If encryption keys are changed periodically for enhanced security, then data security is improved, but operational complexity increases due to the need to re-encrypt large amounts of data
Solution Approach 1:
The system segments encryption operations into key generation and data encryption as separate functions. The encrypted data is stored once, while encryption keys are regenerated periodically and stored separately. This segmentation reduces operational complexity by eliminating the need to re-encrypt large datasets during key rotation.
Solution Approach 2:
The encryption keys are extracted and stored separately from the encrypted data. This allows keys to be regenerated independently without affecting the encrypted data, simplifying the key rotation process and reducing operational complexity while maintaining security.
3Reliability
If the encryption device fails, then data access is disrupted, but data security is compromised if keys and data information are lost
Solution Approach 1:
The system creates and stores copies of encryption keys in multiple locations: the primary encryption device and a secondary secure location. This redundancy ensures that if the primary encryption device fails, the encrypted data remains secure while keys can be recovered from the backup location, preventing both data access disruption and security compromise.
Solution Approach 2:
The system prepares backup encryption keys in advance and stores them securely before any failure occurs. This beforehand cushioning ensures that if the encryption device fails, the system can recover without losing key information or compromising data security, as the backup keys are already prepared and stored.
Data Source
AI summary
Method and system for storing data in a storage device accessible through a storage area network is provided. The method includes receiving data from a host system; generating a first encryption key for encrypting data information that describes the received data; generating a second encryption key that encrypts the first encryption key and the encrypted data information; generating an encryption packet that includes the second encryption key, the first encryption key and the data information; storing the encryption packet at one or more memory locations; and periodically refreshing the encryption packet without periodically encrypting the received data for securely storing the received data.