NAS Encryption Device for Confidential Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in protecting confidential information from unauthorized access by administrators, as they often have unrestricted access due to their administrative privileges, which can compromise data confidentiality despite the need for them to perform legitimate administrative functions.
Innovation Solution
Implementing a dual-path data storage architecture where a file server communicates with a physical storage device through an encryption device, allowing decrypted data access for owners and encrypted data access for administrators, thereby maintaining confidentiality while enabling administrative functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If administrators are granted unrestricted access to files, then they can perform legitimate administrative functions, but data confidentiality is compromised
Solution Approach 1:
The system segments data access paths into separate encrypted and unencrypted routes. Administrators can access metadata and unencrypted data through one path while confidential data remains encrypted through another path, allowing differentiated access based on data sensitivity and user role
Solution Approach 2:
The encryption device acts as an intermediary between the file server and storage. It intercepts read requests and selectively decrypts data based on the requester's identity and the data's encryption status, enabling controlled access without compromising confidentiality
2Object-affected harmful factors
If data is encrypted at rest, then data confidentiality is improved, but access for administrators is restricted
Solution Approach 1:
The system dynamically adjusts the encryption state of data based on the requester's identity. When an administrator requests data, the system determines whether to provide encrypted or unencrypted data based on the specific access context, allowing flexible access control
Solution Approach 2:
Different parts of the data access system have different encryption properties. Metadata and certain data files can be accessed unencrypted by administrators while other confidential data remains encrypted, creating localized access characteristics based on data sensitivity
3Object-affected harmful factors
If dual-path architecture is implemented, then data confidentiality is preserved for super users, but system complexity increases
Solution Approach 1:
The encryption device serves multiple functions: it encrypts data at rest, selectively decrypts data for authorized users, manages encryption keys, and controls access paths. This multi-functionality consolidates security operations into a single device, reducing overall system complexity
Data Source
AI summary
A data storage architecture for networked access by clients includes a file server capable of communication with the clients via the network, physical storage organized as a plurality of logical volumes, and an encryption device in communication with both the file server and the physical storage.