Key Derivation for Storage Cost Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key management methods incur high storage costs due to the need for each data storage party to store multiple encryption keys for different data sets, leading to increased costs as the amount of data grows.
Innovation Solution
A method where a data encryption device uses a one-way function to derive encryption keys from a prestored root key and data identifiers, allowing each piece of data to be encrypted and decrypted without storing individual keys, reducing storage requirements by only storing the root key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each piece of data is encrypted by using a different key, then data security is improved, but storage costs increase due to the need to store multiple keys
Solution Approach 1:
A single root key is used to generate multiple data-specific keys through a key derivation function. The root key serves multiple purposes: it encrypts the metadata and serves as the seed for generating keys for all data pieces, eliminating the need to store multiple separate keys while maintaining security for each data piece
Solution Approach 2:
Instead of storing multiple original keys, the system stores a single root key and uses a key derivation function to generate (copy) the necessary data-specific keys when needed. The key derivation function acts as a deterministic copying mechanism that produces unique keys from the root key based on data identifiers
2Reliability
If multiple encryption keys are stored for different data sets, then data access security is improved, but device complexity increases
Solution Approach 1:
The complexity of managing multiple keys is extracted and replaced by a single root key combined with a key derivation function. The key derivation function encapsulates the logic for generating multiple keys, removing the burden of manual key management while maintaining security
Solution Approach 2:
The system automatically generates data-specific keys through the key derivation function when needed, without requiring manual intervention to manage multiple keys. The root key self-generates the necessary cryptographic material based on data identifiers, reducing operational complexity
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
Implementations of the present specification disclose a key management method, apparatus, and device. In the implementations of the present specification, a key corresponding to data is calculated based on a data identifier of the data and a prestored root key by using a one-way function, and the data is encrypted by using the key corresponding to the data. When a data decryption device needs to be authorized to decrypt certain piece of data, a key corresponding to the data is calculated based on a data identifier of the data and the root key by using the one-way function, and the key corresponding to the data is sent to the data decryption device.