Object Store Cryptographic Function Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The migration of cryptographic functions in object stores leads to increased system resource utilization and challenges in accessing files identified using different cryptographic functions simultaneously, particularly in federated systems where nodes communicate to update system state.
Innovation Solution
The system allows for the transition of an object store from a first cryptographic function to a second cryptographic function while retaining object signatures generated by the first function, enabling incremental migration and concurrent access using both functions, with mechanisms to manage object signatures and storage across nodes in a federated network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic function migration is implemented in object stores, then security and cryptographic flexibility are improved, but system resource utilization increases and access complexity to files identified using different cryptographic functions worsens
Solution Approach 1:
The system segments the object store into multiple namespaces, where each namespace is associated with a specific cryptographic function. This allows files to be organized and accessed according to their cryptographic function without requiring the entire system to handle multiple cryptographic functions simultaneously, thereby reducing system resource utilization while maintaining security.
Solution Approach 2:
The patent introduces namespace objects as intermediaries between the file access requests and the actual data objects. These namespace objects contain metadata including the cryptographic function identifier, enabling the system to route access requests to the appropriate cryptographic context without requiring complex system-wide resource allocation for multiple cryptographic functions.
2Reliability
If cryptographic function migration is implemented in object stores, then security and cryptographic flexibility are improved, but the complexity of accessing files identified using different cryptographic functions simultaneously worsens
Solution Approach 1:
By dividing the object store into separate namespaces based on cryptographic function, the system simplifies file access operations. Users and applications access files within a specific namespace context, eliminating the need to manage multiple cryptographic functions simultaneously and reducing access complexity while maintaining security.
Solution Approach 2:
Namespace objects serve as intermediaries that encapsulate cryptographic function information. When accessing files, the system uses these namespace intermediaries to automatically determine the appropriate cryptographic context, simplifying the access process and reducing operational complexity without compromising security.
3Quantity of substance
If object signatures from different cryptographic functions are retained concurrently, then storage efficiency and resource management are improved, but the complexity of managing and synchronizing these signatures across federated nodes worsens
Solution Approach 1:
The system segments signature management by cryptographic function namespace. Each namespace maintains its own signature validation rules and metadata structures, allowing efficient storage of objects with different cryptographic signatures without requiring complex cross-functional signature management. This segmentation reduces the overall complexity of managing diverse cryptographic signatures across federated nodes.
Data Source
AI summary
In an example, a system may include an object store for storing objects, wherein each object is identified by an object signature generated according to a first cryptographic function, wherein the objects stored in the object store exhibit a hierarchical relationship from a root object. The system may receive a second cryptographic function for the object store, receive an I/O request affecting an object in the object store, encode the affected object according to the second cryptographic function, and persist the affected object alongside other objects in the object store encoded according to the first cryptographic function.