Hierarchical Key Management to Avoid Backup Data Reencryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in efficiently managing encryption keys across various storage architectures and locations, leading to excessive reencryption of backup data and potential security vulnerabilities due to reliance on a single encryption key.
Innovation Solution
A hierarchical key management system is implemented, utilizing a set of encryption keys with multiple layers of key encryption keys (KEKs) and data encryption keys (DEKs), allowing for independent rotation and rekeying of intermediary KEKs to enhance security without frequent reencryption of backup data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single encryption key is used to protect backup data, then the system is simple to manage, but security vulnerabilities arise due to reliance on one key
Solution Approach 1:
The patent divides the encryption key into multiple independent layers: root key encryption keys (KEKs) at the top level and data encryption keys (DEKs) at the bottom level. Each layer can be rotated and managed independently, segmenting the security function to reduce the impact of any single key compromise while maintaining overall system security.
Solution Approach 2:
The patent implements a hierarchical key structure where root KEKs encrypt and protect intermediary KEKs, which in turn encrypt and protect DEKs. This nested arrangement allows multiple encryption layers to be organized in a hierarchical manner, enabling fine-grained control over key rotation and reducing the scope of key management operations.
2Reliability
If frequent reencryption of backup data is performed to rotate keys, then security is improved, but productivity decreases due to excessive reencryption operations
Solution Approach 1:
The patent segments key rotation into two independent operations: rotating root KEKs (which affects all DEKs) and rotating DEKs (which affects only specific data). This segmentation allows selective rotation of only the necessary key layers, avoiding unnecessary reencryption of entire backup datasets and improving operational efficiency.
Solution Approach 2:
The patent introduces intermediary KEKs as mediators between root KEKs and DEKs. These intermediary keys can be rotated independently without requiring reencryption of data encrypted with DEKs. The intermediary layer acts as a buffer that isolates the impact of key rotation operations, allowing security updates without frequent full reencryption.
3Reliability
If a hierarchical key structure with multiple layers is implemented, then key rotation and rekeying can be performed independently to enhance security, but device complexity increases
Solution Approach 1:
The patent designs the hierarchical key structure to serve multiple functions simultaneously: root KEKs provide master encryption and key protection, intermediary KEKs enable selective data encryption and key rotation, and DEKs handle data encryption. This multi-functionality allows a single structured system to address diverse security needs without requiring separate mechanisms for each function.
Solution Approach 2:
The patent implements dynamic key rotation capabilities where each key layer can be rotated independently based on operational needs. The system can dynamically switch between different key layers during encryption and decryption operations, providing flexibility and adaptability without requiring a completely new key system whenever rotation is needed.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may create a first key family including a first key to encrypt and decrypt first data encryption keys associated with first data management jobs. The DMS may create a second key family after encrypting the first data encryption keys using the first key. A first key of the second key family may be used to encrypt and decrypt second data encryption keys that are associated with second data management jobs. The DMS may create a second key of both the first and second key families. The second key of the first key family may be used to decrypt the first data encryption keys. The second key of the second key family may be used to encrypt third data encryption keys and to decrypt the second data encryption keys and the third data encryption keys.