File System Key Rolling via Extent Relocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional encryption techniques on computing devices are vulnerable to modern hacking methods, such as brute-force attacks, which can compromise personal information, and updating encryption keys (key rolling) can inhibit processor performance and consume power, degrading user satisfaction.
Innovation Solution
A method for transparently re-encrypting file extents by iteratively encrypting and relocating them in storage, using a new encryption key, while maintaining read-accessibility and updating metadata to track the re-encryption process, allowing for non-sequential and efficient key rolling without disrupting device operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption techniques are used to protect personal information, then security against casual access is improved, but vulnerability to brute-force attacks increases
Solution Approach 1:
The patent implements periodic key rolling where encryption keys are automatically updated at scheduled intervals or after specific events. This periodic action ensures that even if an attacker captures a key, its usefulness is limited to a specific time window, directly addressing the brute-force vulnerability while maintaining security
Solution Approach 2:
The system dynamically transitions from static encryption keys to dynamic key rolling. Keys are no longer fixed but change over time based on rolling schedules, making the encryption system adaptive and resistant to static cracking methods
2Reliability
If encryption keys are updated frequently to improve security, then resistance to brute-force attacks is improved, but processor performance and user satisfaction deteriorate
Solution Approach 1:
Key rolling is performed periodically rather than continuously, creating scheduled maintenance windows for key updates. This allows normal processing to continue uninterrupted between rolling events, maintaining processor performance while achieving security updates
Solution Approach 2:
The file system is divided into extents, and key rolling is applied selectively to individual extents rather than the entire file system at once. This segmentation allows parallel processing and reduces the performance impact on any single operation
3Reliability
If encryption keys are updated frequently to improve security, then resistance to brute-force attacks is improved, but power consumption increases
Solution Approach 1:
Key rolling operations are scheduled periodically rather than continuously, creating idle periods where power-intensive encryption operations are suspended. This periodic execution pattern significantly reduces average power consumption while maintaining security through regular key updates
Solution Approach 2:
The system dynamically adjusts key rolling frequency and timing based on power availability and usage patterns. During low-power states or when the device is idle, key rolling is scheduled to minimize energy consumption while ensuring security updates occur
4Reliability
If file extents are re-encrypted with new keys, then security is improved, but file accessibility during the process may be affected
Solution Approach 1:
Files are divided into extents that can be encrypted with different keys independently. This allows selective key rolling on specific extents while leaving others accessible, maintaining file accessibility during the transition process
Solution Approach 2:
The file system maintains metadata that maps file extents to their current encryption keys. This intermediary mapping layer allows the system to manage key transitions smoothly, ensuring that applications can access files through the metadata layer even as underlying encryption keys are being updated
Data Source
AI summary
This application sets forth a key rolling technique for a file system of a computing device. The key rolling technique allows for files to be transparently re-encrypted in a background process while still allowing applications to access the files being re-encrypted. During re-encryption, at least one file extent of a file is decrypted using a current key for the file extent and re-encrypted using a new key for the file extent. Moreover, the file extent can be relocated to another location in memory during re-encryption to enhance accessibility and crash protection features. Metadata associated with the file can be updated to include information pertaining to both the location of the re-encrypted file extent as well as the new key that can be used to decrypt the re-encrypted file extent. In this manner, the metadata can be used to properly construct a complete file when the file needs to be accessed.