Automatic Key Cleanup for Data Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key-based encryption systems face challenges in managing numerous encryption keys due to frequent rotation, leading to resource consumption and difficulty in synchronizing with external key managers, as well as increased processing overhead from exporting and importing large numbers of keys.
Innovation Solution
Implementing a key management system that automatically performs regular key cleanup processes, including size-based and time-based key rotation with automatic retry mechanisms, to reduce the number of keys stored and managed, ensuring that unused keys are deleted from the key table, thereby freeing up key table space and maintaining efficient key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent key rotation is implemented to enhance security, then data security is improved, but the number of keys stored and managed increases leading to resource consumption and management difficulty
Solution Approach 1:
The patent implements automatic key cleanup that identifies and removes expired or unused encryption keys from the key table. This principle allows the system to discard obsolete keys that no longer serve a purpose, thereby reducing the total number of keys stored while maintaining security through regular rotation of active keys. The cleanup process recovers key table space and reduces management overhead.
Solution Approach 2:
The system performs key rotation and cleanup operations at periodic intervals defined by rotation policies. Keys are rotated regularly to limit the amount of data encrypted with any single key, and cleanup operations are performed periodically to remove expired keys. This periodic action maintains security while preventing uncontrolled key accumulation.
2Reliability
If aggressive key rotation policy is applied to ensure manageable data subsets, then security is improved, but key synchronization time with external key manager increases
Solution Approach 1:
The patent extracts only the necessary subset of active keys for synchronization with external key managers, rather than synchronizing the entire key table including expired and unused keys. This extraction principle reduces the volume of data requiring synchronization while maintaining security through selective key rotation and cleanup of obsolete keys.
3Reliability
If large number of keys are maintained in the system, then security coverage is improved, but processing overhead for exporting and importing keys increases
Solution Approach 1:
The system automatically identifies and removes keys that are no longer needed for encryption operations, such as expired rotation keys or keys associated with deleted data. This reduces the total key count, thereby decreasing the processing overhead for key export/import operations while maintaining adequate security coverage through proactive key rotation.
Data Source
AI summary
Embodiments for deleting encryption keys in a data storage system by storing a current encryption key in a key table, the current key encrypting at least some data in one or more data containers of a filesystem of the data storage system. A key table maintains a starting container ID and an ending container ID for each container encrypted by the current encryption key, and a deleted container count counting a number of containers of the one or more data containers deleted from the file system. The process determines if the number of containers in the deleted container count equals a number of containers having data encrypted by the encryption key as determined by the starting container ID and ending container ID, and if so, marks the key for deletion in a garbage collection operation, which then deletes the key from the key table.