Namespace Key Caching With Ephemeral Keys for Faster Object Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems face challenges in efficiently synchronizing data across multiple devices, leading to data inconsistencies and loss, while existing encryption methods are costly and slow when sharing or moving data due to frequent calls to third-party key management services.
Innovation Solution
Implementing a tertiary encryption scheme using namespace encryption keys (NEKs) encrypted with top-level encryption keys (TEKs), and temporarily storing ephemeral keys locally to reduce KMS calls and enhance security, allowing instantaneous sharing of objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is encrypted using traditional methods with frequent KMS calls, then security is maintained, but sharing and moving data becomes slow and costly
Solution Approach 1:
The system performs preliminary encryption of namespace keys using ephemeral keys before data transfer operations. By pre-encrypting keys and storing them in cache, the system eliminates the need for frequent real-time KMS calls during data sharing, thus improving speed while maintaining security through the preliminary cryptographic preparation
Solution Approach 2:
The patent introduces ephemeral keys as intermediary cryptographic elements between the KMS and the actual data encryption/decryption processes. These ephemeral keys act as mediators that can be cached and reused, reducing direct KMS calls while maintaining the security chain, thus resolving the contradiction between speed and security
2Loss of time
If KMS calls are reduced by caching keys locally, then cost and speed improve, but security risks increase from storing keys locally
Solution Approach 1:
The system uses ephemeral keys that are short-lived and disposable, stored temporarily in cache memory. These keys are automatically invalidated after use or after a short time period, minimizing the security window for potential breaches while still providing the performance benefits of local caching. This resolves the contradiction by making the cached keys temporary rather than persistent
Solution Approach 2:
The patent changes the temporal parameter of key storage by implementing time-based key rotation and expiration. Keys are stored locally only for the duration needed and are automatically rotated or invalidated after a specified time period, thus reducing security risks associated with long-term local key storage while maintaining the performance advantages of caching
3Productivity
If synchronous encryption/decryption is performed for every data access, then security is maintained, but system performance and productivity decrease
Solution Approach 1:
The patent merges multiple encryption operations by caching decrypted namespace keys in memory after the first decryption operation. Subsequent data access operations within the same session can reuse the cached keys without repeating the full decryption chain, thus combining multiple security operations into one initial operation and significantly improving productivity while maintaining encryption consistency through the cached cryptographic material
Data Source
AI summary
A system, method, and computer readable medium is disclosed for accessing an object that is encrypted within at least a tertiary-level encryption key scheme. This includes receiving a request to access blocks making up an object by content management system and using a top-level encryption key from a key management service, a namespace encryption key from a namespace encryption key database, and a respective block encryption keys protecting the blocks making up the object. Furthermore, the system can rely on ephemeral keys to encrypt the namespace encryption keys, so that namespace encryption keys can be stored at the content management system. Using these keys, the system can decrypt the namespace encryption key using the ephemeral key, decrypt the block encryption keys using the namespace encryption key and decrypt the blocks using the block encryption keys, thereby providing access to the object.