Hierarchical Encryption for Instant Crypto Shredding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure storage systems face challenges in responding quickly to compromised encryption keys, especially in snapshot-based and deduplicated systems, where data sanitization is slow and inefficient due to the complexity of managing multiple keys and shared data blocks.
Innovation Solution
The implementation of hierarchical encryption techniques that allow for auto key rotation by modifying the encryption key of the root node, enabling instant crypto shredding and efficient key management through convergent encryption in a directed acyclic graph structure, where each node is encrypted with a unique key based on its content, facilitating quick decryption and sanitization processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption key rotation is implemented by walking through the storage system namespace and re-encrypting all data blocks, then security is improved by responding to compromised keys, but the system suffers from slow response time and long processing duration
Solution Approach 1:
The patent divides the storage system into a hierarchical namespace structure where data is organized in trees with root nodes, intermediate nodes, and leaf nodes. Each node can be independently encrypted with its own key, allowing selective re-encryption of only the affected subtree when a key is compromised, rather than re-encrypting the entire storage system. This segmentation enables rapid response to security threats by limiting the scope of re-encryption operations to only the necessary portions of the namespace.
2Productivity
If deduplication is implemented to share data blocks amongst multiple entities, then storage efficiency is improved, but key management complexity increases significantly
Solution Approach 1:
The patent implements a universal key management mechanism where a single encryption key at each namespace node protects multiple data blocks that are shared across different files, snapshots, and clones. Instead of managing separate keys for each data block or entity, the system uses hierarchical encryption where one key can secure multiple references to the same data, greatly simplifying key management while maintaining deduplication efficiency.
3Productivity
If snapshot-based systems share data blocks amongst multiple snapshots, then storage efficiency is improved, but the ability to perform instant data sanitization is lost
Solution Approach 1:
The patent extracts the encryption key management from the data blocks themselves and places it at the namespace hierarchy level. Each namespace node (file, directory, snapshot) has its own encryption key stored in its metadata. When data sanitization is needed, the system simply removes or invalidates the key at the namespace node level, instantly rendering all shared data blocks inaccessible. This extraction of key management to the namespace level enables instant sanitization without requiring physical deletion or modification of shared data blocks.
4Productivity
If reference counting is not implemented for individual data blocks to maintain efficiency, then system performance is improved, but the ability to identify unreferenced data blocks for sanitization is lost
Solution Approach 1:
The patent introduces namespace nodes (files, directories, snapshots) as intermediaries between the encryption key management system and the underlying data blocks. Instead of directly tracking references to individual data blocks, the system uses these intermediary namespace nodes to manage encryption keys. The hierarchical structure automatically tracks which data blocks are referenced by which namespace nodes, enabling efficient identification of unreferenced blocks through the intermediary layer without requiring direct reference counting at the block level.
Data Source
AI summary
In one embodiment, in response to a request received from a client for retrieving a data object stored in a storage system, a root key is obtained from the request. The data object is represented by metadata in a hierarchical structure having a plurality of levels. Each level includes a plurality of nodes and each node being one of a root node, a leaf node and an intermediate node. The hierarchical structure of metadata associated with the data object is traversed in a top-down approach to decrypt each of a plurality of nodes in the hierarchical structure using a key provided from its parent node, starting from the root node to the leaf nodes, including decrypting the root node using the root key. Decrypted data associated with the plurality of nodes is transmitted to the client.