Hierarchical Key System for Secure Object Store Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current techniques for securing information in secure storage systems are inadequate for virtual machines, as they rely on custom hardware and do not support secure sharing of data across clusters or enforce access control, leading to issues with encryption key generation and data access management.

Innovation Solution

A hierarchical key system is implemented, using randomly generated Node Key Encryption Keys stored under Unlock Key Encryption Keys, with each data object encrypted under its own random Data Encryption Key, and shared Data Encryption Keys encrypted under Storage Class Key Encryption Keys, allowing secure sharing and access control across nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If custom hardware is used for key generation, then security is improved, but hardware requirements and system complexity increase

Engineering Contradiction:

ImprovesecurityVSAvoidhardware requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces the mechanical/custom hardware system for key generation with a software-based cryptographic approach using standard computing components. The hierarchical key system uses software-generated encryption keys and cryptographic protocols to achieve the same security objectives without requiring specialized hardware, thus resolving the contradiction between security and hardware complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Device complexity

If data is encrypted under a single key, then encryption is simplified, but secure sharing across clusters becomes impossible

Engineering Contradiction:

Improveencryption complexityVSAvoidsecure sharing capability

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The patent segments the single encryption key into a hierarchical structure with multiple keys at different levels (cluster-level keys, object-level keys, and data encryption keys). This segmentation allows different portions of the hierarchy to serve different purposes: cluster-level keys enable sharing across clusters, while object-level keys provide fine-grained access control, thus resolving the contradiction between encryption simplicity and sharing capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements a nested hierarchical key structure where outer keys encrypt inner keys, and inner keys encrypt data. The cluster-level encryption key is nested within the hierarchical structure, allowing it to decrypt and reveal inner keys that subsequently decrypt individual objects. This nesting enables secure sharing across clusters while maintaining individual object security and access control.

Inventive Principle:

Principle #7Nested doll (Nesting)

3Ease of operation

If access control is not enforced, then data access is simplified, but security and authorization management deteriorate

Engineering Contradiction:

Improvedata accessVSAvoidaccess control

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent applies local quality by associating specific access control attributes with individual data objects rather than applying uniform access control to all data. Each encrypted object can have its own access control list (ACL) or permissions defined at the object level, allowing different authorization rules for different objects while maintaining a unified hierarchical key structure. This enables simplified access for authorized users while enforcing security at the appropriate granular level.

Inventive Principle:

Principle #3Local quality

4Adaptability or versatility

If virtual machines are supported without custom hardware, then system versatility is improved, but key generation security may be compromised

Engineering Contradiction:

Improvevirtual machine supportVSAvoidkey generation security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent creates a universal hierarchical key system that functions across multiple environments including physical machines, virtual machines, and distributed clusters. The software-based key generation and management approach eliminates dependency on custom hardware, making the system universally applicable to virtualized environments while maintaining security through cryptographic best practices and hierarchical key relationships that work consistently across different platform types.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11113408B2Providing a secure object store using a hierarchical key system

Publication Date: 2021.09.07 HEWLETT PACKARD ENTERPRISE DEV LP

AI summary

A method for use in managing a secure object store in a computing system includes: securing the secure object store including creating, maintaining, and using a hierarchical key system and accessing an encrypted data object using the Node Key Encryption Key and a selected one of the Data Encryption Keys. The securing includes: generating a Node Key Encryption Key; generating a plurality of Data Encryption Keys that are encrypted using the Node Key Encryption Key; and encrypting a plurality of data objects using the Data Encryption Keys, each data object being encrypted by a respective Data Encryption Key.