Key Wrapping for Secure Multi-Authority Storage Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems provide inadequate security mechanisms for selectively allowing access to data, often compromising performance.
Innovation Solution
A system and method for key wrapping that enables secure access to media by multiple authorities with modifiable permissions, utilizing a global administrator key, range keys, and range key encrypting keys, which are encrypted and stored on a non-volatile memory, allowing administrators and users to manage access and permissions dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms are used for data access control, then security is provided, but performance deteriorates
Solution Approach 1:
The security system is segmented into multiple hierarchical levels: storage encryption keys, volume encryption keys, file encryption keys, and user credentials. Each level operates independently with specific security functions, allowing performance optimization at each layer without compromising overall security. The segmentation enables parallel processing of encryption operations across different data blocks.
Solution Approach 2:
Encryption keys serve as intermediaries between user credentials and encrypted data. Instead of direct authentication checks on every data access, the system uses pre-computed encrypted keys stored in the volume, which can be rapidly decrypted and applied without repeated credential verification, thus improving access performance while maintaining security.
2Adaptability or versatility
If access permissions are made modifiable for multiple authorities, then flexibility and adaptability improve, but system complexity increases
Solution Approach 1:
The authority structure is segmented into administrators and users with distinct permission sets. Administrators have full access to modify any permissions, while users have limited access to their own credentials and authorized files. This segmentation simplifies the permission matrix and makes the system more manageable despite supporting multiple authorities.
Solution Approach 2:
The permission system is designed to be dynamic, allowing administrators to modify user permissions and credentials at any time without system reconfiguration. The encrypted key structure allows seamless updates where new permissions are applied by regenerating and re-storing encrypted keys, maintaining system operation without interruption or complexity increase.
3Reliability
If encrypted keys are stored on the drive for multiple users, then secure access is enabled, but storage space and system overhead increase
Solution Approach 1:
The system creates encrypted copies of authentication keys and stores them directly in the volume structure. Each user's access credentials are transformed into encrypted key copies that reside in the storage medium, eliminating the need for external key management systems. This copying approach enables fast local authentication while the encryption ensures security, and the overhead is minimized through efficient storage integration.
Data Source
AI summary
Aspects of the disclosure pertain to a system and method for key wrapping via a storage system to allow secure access to media of the system by multiple authorities with modifiable permissions. The keys used to encrypt ranges of the drive are not stored in plaintext and are recoverable using the credentials of an administrator or user with access to that particular range. An outside attacker cannot recover these keys and a malicious user can only recover the keys to the ranges that user is allowed to access. This is maintained while allowing administrators to modify permissions at any time and, while allowing both administrators and users to change their credentials at any time.