Storage System Encryption with KMS and TPM Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data encryption methods that store Data Encryption Keys (DEK) and Key Encryption Keys (KEK) on the same system are vulnerable to unauthorized access and data loss, particularly when data is tiered to the cloud, leading to performance bottlenecks and security risks.
Innovation Solution
Implementing a system where the KEK is not stored on the storage system and using a Trusted Platform Module (TPM) to protect and cache DEKs in memory, with a Key Manager Server (KMS) managing the KEK externally, ensuring that DEKs are never accessible by the storage system and utilizing an LRU cache and pre-fetching to optimize key availability for cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If KEK and DEKs are stored on the same system, then key management is simplified, but security is compromised and data loss risk increases
Solution Approach 1:
The patent segments key management into two separate systems: a KMS (Key Management Server) that stores and manages KEKs, and a storage system that stores DEKs encrypted with KEKs. This segmentation prevents a single point of failure and enhances security by ensuring that compromise of one system does not automatically compromise all keys.
Solution Approach 2:
The KEK is extracted from the storage system and placed in a separate KMS. The KMS holds the KEK in encrypted form and only provides decryption services when needed, preventing the storage administrator from having direct access to the KEK and thus preventing accidental or malicious data loss.
2Reliability
If KEK is stored externally in KMS, then security is improved, but read performance deteriorates due to network requests
Solution Approach 1:
The storage system proactively requests and caches DEKs from the KMS before they are needed for decryption operations. This preliminary action ensures that when data decryption is required, the DEKs are already available in local cache, eliminating network latency during actual read operations.
Solution Approach 2:
A local cache acts as an intermediary between the storage system and the external KMS. The cache stores frequently accessed DEKs locally, reducing the frequency of network requests to the KMS while maintaining security through the external key management architecture.
3Productivity
If all keys are stored in memory to resolve read bottlenecks, then read performance improves, but security is compromised to memory attacks
Solution Approach 1:
The patent applies different security characteristics to different parts of the key management system. The KMS stores KEKs in a secure, access-controlled environment with audit capabilities, while the storage system stores only encrypted DEKs locally. This local quality approach ensures that even if the storage system memory is compromised, the KEKs remain protected in the separate KMS.
4Adaptability or versatility
If storage administrator can access KEK, then operational flexibility is improved, but data loss risk increases
Solution Approach 1:
The KMS acts as an intermediary that provides controlled access to KEKs. When operational flexibility is needed (such as key rotation or recovery), the storage administrator can request key operations through the KMS, which maintains security controls and audit trails. This prevents direct access that could lead to accidental or malicious data loss while still allowing necessary administrative operations.
Data Source
AI summary
One example method includes receiving clear text data at a storage system, generating, at the storage system, a clear text data encryption key, requesting a key management system to encrypt the clear text data encryption key with a master key to create an encrypted data encryption key, and the requesting is performed by the storage system, receiving, at the storage system, the encrypted data encryption key from the key management system, encrypting, at the storage system, the clear text data with the clear text data encryption key to create encrypted data, and storing, together, the encrypted data and the encrypted data encryption key.