Multi-tier file system with transparent holes for encryption key rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption key rotation solutions limit data volume per tenant, require service downtime, or necessitate special coding, making it difficult to manage encryption keys efficiently in cloud-based applications, especially during key changes or regulatory compliance.
Innovation Solution
Implementing a multi-tier file system with transparent holes that allows for seamless encryption key rotation by using a platform-independent disk encryption format, enabling data to be encrypted on disk but decrypted in memory, and using a union file system to manage multiple encryption keys without disrupting application functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing encryption key rotation solutions are used, then encryption key rotation can be performed, but service downtime occurs and data volume per tenant is limited
Solution Approach 1:
The patent segments the file system into multiple tiers (first tier, second tier, third tier) where each tier can be independently managed with different encryption keys. This allows key rotation to occur in one tier without affecting other tiers, enabling continuous service during key rotation operations.
Solution Approach 2:
The patent performs preliminary actions by pre-initializing multiple tiers with different encryption keys before key rotation is needed. The second tier is pre-initialized with a second encryption key while the first tier uses the first encryption key, allowing seamless transition without service interruption.
2Reliability
If data is encrypted on disk, then data security is improved, but access speed decreases due to decryption overhead
Solution Approach 1:
The patent applies different encryption/decryption characteristics to different tiers locally. Frequently accessed data can be kept in upper tiers with faster access, while less frequently accessed data resides in lower tiers. Each tier can be optimized for its specific access patterns, balancing security and performance locally rather than uniformly across all data.
Data Source
AI summary
The technology disclosed includes access to content and encryption key rotation in a multi-generational file system that has a first tier file, and automatically initializes a second tier file accessible using a same path and file name as the first tier file. The disclosed technology includes copying forward blocks of data from the first tier file to the second tier file, and prior to completion of the copying forward, responding to an access request by accessing the second tier file by providing data available from the second tier file that has been copied forward and by following links associated with the holes to access blocks in the first tier file to provide data from the first tier file. The first tier files are encrypted using a first encryption key; and applying a second encryption key to encrypt data in the second tier files during the copying forward and write access.