Encryption Key Hierarchy for Rekeying Immutable Backup Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in securely managing encryption keys across multiple storage locations, particularly in scenarios where rekeying is required, especially when dealing with immutable storage locations that do not allow re-encryption of data.
Innovation Solution
A hierarchical encryption key management design is implemented, utilizing a root KEK at the top, intermediary KEKs at lower levels, and DEKs at the bottom, with key rotation and rekeying mechanisms that allow updating encryption keys without re-encrypting stored data, and a centralized dashboard for key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rekeying is performed on immutable storage locations, then security is improved through key rotation, but data integrity is compromised because re-encryption is not possible
Solution Approach 1:
The encryption key hierarchy is segmented into multiple levels (master KEK, intermediary KEKs, and DEKs) with distinct roles. The master KEK encrypts the root KEK, intermediary KEKs encrypt DEKs, and DEKs encrypt data. This segmentation allows the master KEK to be rotated without affecting the DEKs or encrypted data, resolving the contradiction between security improvement and data integrity.
Solution Approach 2:
Intermediary KEKs serve as mediators between the master KEK and DEKs. When the master KEK is rotated, only the root KEK needs to be re-encrypted with the new master KEK, while intermediary KEKs and DEKs remain unchanged. This intermediary layer isolates the impact of key rotation to only the necessary components, preserving data integrity.
2Reliability
If key rotation is implemented across all storage locations, then security is enhanced, but system complexity increases due to multiple storage locations with different encryption keys
Solution Approach 1:
The master KEK serves multiple functions: it encrypts the root KEK for immutable storage locations and acts as a common root for all intermediary KEKs in mutable storage locations. This universal master KEK provides a single point of control for key rotation across diverse storage locations, enhancing security without proportionally increasing system complexity.
Solution Approach 2:
The encryption key hierarchy uses a nested structure where the master KEK contains the root KEK, which contains intermediary KEKs, which in turn contain DEKs. This nested arrangement allows key rotation at any level to propagate downward through the hierarchy, enabling secure key management across multiple storage locations while maintaining a unified, manageable structure.
3Reliability
If re-encryption is performed on stored data, then security is improved through key updates, but storage operations become more complex and time-consuming
Solution Approach 1:
The system performs preliminary action by encrypting the master KEK and root KEK before they are needed for data encryption. When key rotation is required, only these pre-prepared key containers need to be updated, not the actual data. This preliminary preparation allows secure key updates without requiring time-consuming re-encryption of stored data, maintaining storage operation efficiency.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may store encrypted backup data across one or more storage locations using a hierarchical encryption key management design. The hierarchical design may include data encryption keys (DEKs) that are used to encrypt the backup data, and may also include one or more layers of key encryption keys (KEKs). For example, a root KEK may be implemented at the top of the hierarchy and may be used to encrypt intermediary KEKs, while intermediary KEKs may be implemented at one or more lower levels of the hierarchy and may be used to encrypt other intermediary KEKs and/or the DEKs, with the DEKs at the bottom of the hierarchy and used to encrypt data. In some examples, the root KEK may be wrapped by a customer master key, enabling customers of the DMS to provide their own encryption keys.