Hierarchical Encryption Keys for Fast Cloud Object Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage systems face challenges in efficiently managing encryption keys, leading to data inconsistencies, loss of data, and slow sharing or moving of objects due to the reliance on global security keys and frequent access to expensive Key Management Services (KMS).
Innovation Solution
Implementing a tertiary-level encryption key scheme that uses namespace encryption keys (NEKs) encrypted with top-level encryption keys (TEKs), allowing for efficient key management and instantaneous sharing of objects by sharing the namespace encryption key, reducing the need for frequent KMS access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If global security keys are used for encryption, then data security is maintained, but key management becomes complex and KMS access costs increase
Solution Approach 1:
The patent segments the encryption key hierarchy into multiple levels: root keys at the top level, namespace keys for specific data namespaces, and object keys for individual objects. This segmentation distributes key management responsibilities, reducing the complexity of managing a single global key while maintaining security through the hierarchical structure.
Solution Approach 2:
The patent introduces a hierarchical dimension to key management, transitioning from a flat global key structure to a multi-level hierarchy. This adds organizational structure and control planes, allowing keys to be managed at different levels (root, namespace, object) rather than as a single entity, thereby reducing management complexity.
2Reliability
If global security keys are used for encryption, then data security is maintained, but KMS access costs increase due to frequent access
Solution Approach 1:
The patent performs preliminary actions by pre-establishing namespace keys and caching them locally. When objects within a namespace need to be accessed, the system uses the cached namespace key rather than repeatedly accessing KMS for each object, thereby reducing KMS access frequency and associated costs while maintaining security through the pre-established key hierarchy.
Solution Approach 2:
The patent creates and caches copies of namespace keys locally within the content management system. Instead of repeatedly accessing the central KMS service, the system uses these local copies for encryption and decryption operations, significantly reducing KMS access costs while maintaining data security through the hierarchical key structure.
3Reliability
If global security keys are used for encryption, then data security is maintained, but object sharing and moving become slow due to decryption delays
Solution Approach 1:
The patent segments the encryption scope by namespace, creating namespace-specific keys rather than using a single global key. When sharing or moving objects between namespaces, the system only needs to manage and transfer the relevant namespace keys rather than decrypting and re-encrypting all objects with a global key, thereby significantly improving sharing speed while maintaining security.
Solution Approach 2:
The patent applies different encryption keys to different namespaces based on their specific access requirements. When sharing objects, only the namespace key for the target namespace needs to be updated or transferred, not the entire global key hierarchy. This localized key management approach accelerates object sharing and moving operations while maintaining data security.
4Stability of the object's composition
If synchronization of data across multiple devices is implemented, then data consistency is achieved, but data loss and inconsistencies occur due to synchronization difficulties
Solution Approach 1:
The patent segments data into namespaces, each with its own encryption key and access control policies. This segmentation allows independent management and synchronization of different data namespaces across devices, reducing the risk of widespread data inconsistency or loss. Each namespace can be synchronized independently with its own key management, isolating potential synchronization issues.
Data Source
AI summary
A system, method, and computer readable medium is disclosed for accessing an object that is encrypted within at least a tertiary-level encryption key scheme. This includes receiving a request to access blocks making up an object by content management system and using a top-level encryption key from a key management service, a namespace encryption key from a namespace encryption key database, and a respective block encryption keys protecting the blocks making up the object. Using these keys, the system can decrypt the block encryption keys using the namespace encryption key and decrypt the blocks using the block encryption keys, thereby providing access to the object.