Key Consistency Verification in Encrypting Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data encryption in storage systems can lead to inconsistencies in key information over time, potentially rendering data unrecoverable if the encryption or decryption key becomes inconsistent, especially in systems with extended operating periods.
Innovation Solution
The system checks for consistency of key information before performing encryption or decryption operations by maintaining local and central key structures, comparing address information, and using hash values to verify the correctness of key usage across storage processors and I/O modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is implemented in storage systems, then data security is improved, but key information consistency deteriorates over time
Solution Approach 1:
The system performs preliminary consistency verification of encryption keys before data encryption/decryption operations. The key verification module checks whether the encryption key stored in the key management module matches the key information in the I/O command before allowing the operation to proceed, preventing key inconsistency issues from affecting data security
Solution Approach 2:
The system implements a feedback mechanism where the key verification module continuously monitors and verifies key consistency between the key management module and I/O commands. When inconsistency is detected, the system provides feedback to prevent the operation, ensuring key information consistency is maintained throughout the storage system's operation
2Stability of the object's composition
If local and central key structures are maintained for verification, then key consistency is improved, but system complexity increases
Solution Approach 1:
The patent introduces a key verification module as an intermediary component that mediates between the key management module and I/O commands. This module extracts key information from commands, verifies consistency with stored keys, and controls operation execution, thereby managing the complexity of maintaining both local and central key structures through a dedicated verification layer
3Reliability
If key verification is performed before encryption/decryption, then data integrity is improved, but processing time increases
Solution Approach 1:
The key verification module performs a focused, partial verification action by extracting only the necessary key information from I/O commands and comparing it with the stored encryption key. This selective verification approach ensures data integrity through essential checks while minimizing the time overhead compared to comprehensive verification methods
Data Source
AI summary
A data storage system employs data encryption to increase data security, and techniques for ensuring consistency of key information maintained and used throughout the system to reduce the likelihood that data will become non-recoverable due to the use of an incorrect encryption key. In one aspect, a verification process is performed between a key table at a central storage processor and key tables containing decrypted copies of the same information that are stored and utilized at separate input/output (I/O) modules. The verification process includes computing respective hash values at the I/O modules and at the storage processor and comparing the hash values to determine whether they match, a match indicating that the tables are consistent and a non-match indicating that the tables are not consistent. In another aspect, an I/O module performs a check prior to performing an encryption/decryption operation as part of processing an I/O command to ensure that the correct key will be utilized. This check involves comparing address information from the I/O command to address information stored in association with the data encryption key. If the address information is consistent, it indicates that the specified data encryption key is the correct key to be used for the encryption/decryption operation.