Encryption Zone Management for Multi-User Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional storage systems lack inheritability and efficient management of encryption access rights, making it tedious to provide group access to encrypted information units, as encryption keys are not inherited and require manual granting of decryption rights.
Innovation Solution
The implementation of encryption zones with a zone root key and an encryption key chain, where each information unit is encrypted with the key of its most-proximate previous node, allowing automated management of access and inheritability of access control policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption methods are used where each information unit has its own encryption key, then data security is maintained, but access rights management becomes complex and requires manual intervention for each user
Solution Approach 1:
The patent segments information units into encryption zones based on their access control policies. Each encryption zone is associated with a zone root key, and information units within the same zone share the same encryption key. This segmentation reduces the number of unique encryption keys from one per information unit to one per encryption zone, simplifying access rights management while maintaining security through zone-based access control.
2Adaptability or versatility
If manual granting of decryption rights is used for each information unit, then fine-grained access control is achieved, but the process becomes tedious and time-consuming
Solution Approach 1:
The patent merges access control by associating multiple information units with the same access control policy to a single encryption zone and a single zone root key. This allows administrators to manage access rights at the zone level rather than individually for each information unit, significantly reducing the time and effort required for key management while maintaining adaptable access control through policy-based zone creation.
3Reliability
If encryption keys are not inherited in hierarchical structures, then each node maintains independent security, but group access to encrypted information units cannot be efficiently provided
Solution Approach 1:
The patent implements a nested structure where encryption zones are organized in hierarchical relationships. Child encryption zones can inherit the zone root key from parent zones, creating a nested key hierarchy. This allows information units in child zones to automatically inherit access rights from parent zones, enabling efficient group access while maintaining independent security boundaries through the hierarchical zone structure.
Data Source
AI summary
In a storage system, multiple information units are individually associated with an access control policy (ACP) of multiple ACPs. Each respective information unit corresponds to a respective information unit encryption key (IUEK). The multiple information units are grouped into encryption zones based on their associated ACPs. In a described implementation, each ACP is associated with a zone root key (ZRK). In another described implementation, each IUEK corresponding to a given information unit is encrypted by an IUEK corresponding to an information unit at a most-proximate linked node of the storage system.