Hardware Resource Manager Conditional Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems lack efficient methods to manage and secure security keys used for encrypting data on storage devices, particularly in scenarios where communication with a Key Management Service (KMS) is lost.
Innovation Solution
The implementation of a hardware resource manager that stores key storage policies and key purge policies, which specify conditions for obtaining, storing, and deleting security keys. This includes using a combination of synchronized real-time timers and countdown timers to determine when to purge security keys after a lost connection to the KMS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security keys are stored locally in the storage system, then data can be accessed and decrypted even when communication with the KMS is lost, but the risk of unauthorized access increases if the connection is compromised
Solution Approach 1:
The system performs preliminary actions by establishing communication with the KMS and obtaining security keys before the storage system needs to operate independently. The hardware resource manager stores the KMS network information and security keys in advance, so when communication is lost, the system can still access data using the pre-obtained keys. This resolves the contradiction by preparing security credentials beforehand, ensuring both data accessibility and controlled security.
Solution Approach 2:
The hardware resource manager acts as an intermediary between the storage system and the KMS. It manages the security keys and network information, deciding when to store or purge keys based on connection status. This intermediary layer provides controlled access - maintaining keys for accessibility while managing their security through policy-based purging, thus resolving the contradiction between data accessibility and unauthorized access risk.
2Object-affected harmful factors
If security keys are purged immediately when KMS connection is lost, then unauthorized access is prevented, but data accessibility is compromised
Solution Approach 1:
The system performs preliminary actions by obtaining and storing security keys and KMS network information before communication is lost. The hardware resource manager has already cached the necessary credentials, so when the connection drops, the system can continue operating with stored keys rather than immediately purging them. This preliminary preparation resolves the contradiction by ensuring keys are available for legitimate access while maintaining security controls.
Solution Approach 2:
The key retention policy is dynamic rather than static. The hardware resource manager continuously monitors connection status and adjusts key retention accordingly - maintaining keys when connection is lost but purging them when connection is restored or after a timeout period. This dynamic approach resolves the contradiction by adapting key management to the current system state, balancing accessibility and security.
3Reliability
If the system continuously monitors KMS connection status, then security keys can be purged promptly when connection is lost, but system complexity and resource consumption increase
Solution Approach 1:
The hardware resource manager implements a feedback mechanism by monitoring KMS connection status and using this information to trigger key purging actions. The system periodically checks or receives notifications about connection status, and based on this feedback, automatically purges security keys when the connection is lost or restored. This automated feedback loop resolves the contradiction by providing reliable security monitoring without requiring complex manual intervention systems.
Solution Approach 2:
The hardware resource manager performs self-service by autonomously managing security key lifecycle based on connection status. It monitors its own connection state to the KMS and automatically purges or retains keys without external intervention. This self-managing approach resolves the contradiction by implementing security monitoring with minimal additional complexity, as the system manages its own security credentials based on its operational state.
4Reliability
If security keys are retained for extended periods after connection loss, then data accessibility is maintained, but the window for potential unauthorized access increases
Solution Approach 1:
The system implements periodic action by monitoring connection status at regular intervals and automatically purging keys after a predetermined timeout period following connection loss. Rather than retaining keys indefinitely or purging them immediately, the system uses time-based policies to periodically reassess whether to maintain or purge keys. This periodic reassessment resolves the contradiction by limiting the key retention window to a controlled duration, balancing accessibility with security.
Solution Approach 2:
The system changes parameters dynamically based on connection status - transitioning from a state where keys are retained for accessibility to a state where keys are purged for security. The hardware resource manager modifies the key retention parameter based on the elapsed time since connection loss and the current connection status. This parameter change approach resolves the contradiction by adapting the key retention duration to the specific operational context, optimizing both accessibility and security.
Data Source
AI summary
A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.