Lexicographic Key Derivation for Secure Data Deletion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for secure data deletion, such as overwriting and cryptographic key management, face challenges in efficiently deleting data from various storage media, especially in complex file systems and across different media types, due to lack of knowledge about lower-layer implementation mechanisms and inefficient key management.
Innovation Solution
A method involving an ordering vector and base keys associated with each dimension of a lexicographic order, where a key is derived by applying a one-way function corresponding to the ordering vector's values, enabling secure encryption and deletion of objects by managing keys rather than the objects themselves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data overwriting is used for secure deletion, then data security is improved, but deletion efficiency deteriorates for large files and replicated data
Solution Approach 1:
The patent extracts the deletion target from the data itself to the cryptographic key. Instead of overwriting the actual data blocks, the system deletes the key used to decrypt the data. This extraction transforms the deletion operation from a time-consuming data-overwriting process into a simple key-deletion operation, resolving the contradiction between security and efficiency.
Solution Approach 2:
The patent inverts the traditional deletion approach by protecting data through encryption rather than through physical deletion. The security mechanism is flipped from 'delete data to protect' to 'encrypt data to protect, then delete key for permanent security'. This inversion allows efficient key deletion to achieve the same security goal as time-consuming data overwriting.
2Reliability
If multiple keys are managed for each individual file, then secure deletion capability is improved, but key management complexity increases
Solution Approach 1:
The patent merges the keys of multiple files into a single aggregate key. Instead of managing separate keys for each file, the system combines them into one key that protects all files. This merging reduces key management complexity from O(n) separate keys to a single key, while maintaining secure deletion capability through the aggregate key structure.
Solution Approach 2:
The patent creates a universal key structure where a single aggregate key serves multiple files simultaneously. This multi-functional key can be used to encrypt and protect multiple individual files, eliminating the need for separate key management for each file and simplifying the overall key management system.
3Duration of action of stationary object
If data is retained longer for business purposes, then data availability is improved, but security risk increases due to potential breaches and subpoenas
Solution Approach 1:
The patent implements dynamic key expiration tied to retention policies. Keys are automatically updated or revoked based on time-based or event-based triggers, allowing data to be retained for business purposes while systematically reducing security risk through automated key lifecycle management. This dynamic approach enables flexible retention periods with built-in security decay.
Data Source
AI summary
A computer-implemented method for storing an object includes providing an object, an ordering vector of the object, the ordering vector being associated to a lexicographic order having at least one dimension, and base keys associated to each dimension of the lexicographic order; deriving a key by retrieving the base key associated to the first dimension of the lexicographic order for which the ordering vector has a value different from the smallest value, and applying a one-way function a number of times corresponding to the value of the ordering vector for the last dimension of the lexicographic order; encrypting the object with the key; and storing the object as encrypted.