Load-Dependent Encryption Selection in Elastic Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face challenges in providing secure encrypted block storage devices due to the mismatch between storage and computational resources, where host devices often have sufficient storage resources but lack the necessary computational resources for encryption, and maintaining security is complicated by the need to isolate encryption from user input/output operations.
Innovation Solution
The system dynamically selects an appropriate encryption mechanism based on the load of computational and storage resources, using isolated or non-isolated resources, and decouples computational and storage resource loads to efficiently utilize resources while ensuring security, by identifying a target server and encryption server within the cloud provider network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption operations are performed on host devices with sufficient storage resources, then data security is improved, but computational resource availability deteriorates due to the heavy processing load
Solution Approach 1:
The system segments the encryption function from the storage function by introducing dedicated encryption servers that handle only encryption operations, while host devices focus on storage and I/O operations. This separation allows encryption to be performed securely without consuming computational resources of host devices that are needed for storage operations.
Solution Approach 2:
The patent introduces encryption servers as intermediary components between host devices and storage systems. These servers act as mediators that perform encryption operations on data before it is stored, eliminating the need for host devices to perform computationally intensive encryption while maintaining security requirements.
2Reliability
If encryption operations are isolated from user I/O operations, then security is improved, but system complexity increases due to separate encryption infrastructure
Solution Approach 1:
The encryption servers are designed as universal components that can service multiple host devices and storage systems simultaneously. This multi-functionality reduces overall system complexity by consolidating encryption capabilities into shared infrastructure rather than requiring dedicated encryption mechanisms at each host device.
Solution Approach 2:
The system implements self-service mechanisms where encryption servers automatically manage encryption operations without requiring direct user intervention or complex configuration. The encryption process is transparent to users, who simply interact with the storage system while encryption is handled automatically by the infrastructure.
3Productivity
If dynamic encryption mechanism selection is implemented, then resource utilization efficiency is improved, but control complexity increases due to load monitoring and decision-making logic
Solution Approach 1:
The system implements feedback mechanisms where the load monitor continuously monitors computational resource usage and provides real-time information to the encryption mechanism selector. This feedback loop enables dynamic adaptation of encryption strategies based on current system conditions, optimizing resource utilization while maintaining manageable control complexity through automated decision-making.
Data Source
AI summary
Systems and methods are described for implementing load-dependent encryption mechanism selection in an elastic computing system. The elastic computing system can include a set of host devices configured to implement block storage volumes on behalf of users. Users may desire that such volumes be encrypted prior to storing data. It may be generally preferable for encryption to occur on the same host devices that host the volume, to reduce latency and bandwidth usage needed to encrypt the data. However, encryption of data can utilize significant computational resources, which may not be available on host devices that also have sufficient storage resources to host the volume. The present disclosure describes systems and methods that can account for computational resource availability on host devices, selecting “in-place” encryption only when available resources exist on host devices, and otherwise implementing remote encryption of volume data.