Passive Encryption Key Distribution for Distributed Data Stores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing multiple encryption schemes in distributed data storage systems is complex, especially in large systems where the number of data items and locations can overwhelm resources, making it difficult to ensure proper encryption key distribution and access control.
Innovation Solution
The implementation of passive distribution of encryption keys allows clients to distribute keys to storage locations on-demand, enabling access to encrypted data volumes while maintaining client control over access authority and reducing the workload on the distributed data storage system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple encryption schemes are implemented in distributed data storage systems, then data security and access control are improved, but system complexity and key management workload increase
Solution Approach 1:
A key distribution service is introduced as an intermediary component between clients and storage locations. This service receives key distribution requests from clients, determines the appropriate encryption keys based on access authority, and distributes them to the relevant storage locations. This intermediary approach maintains security while reducing the complexity burden on individual system components.
Solution Approach 2:
The system enables clients to autonomously request and receive encryption keys from the key distribution service based on their access authority. Clients can independently manage their own key distribution needs without requiring manual administrative intervention, thereby reducing operational complexity while maintaining security controls.
2Ease of operation
If encryption keys are distributed to all storage locations, then access control is simplified, but resource workload and processing overhead increase
Solution Approach 1:
Instead of uniformly distributing keys to all storage locations, the system implements selective key distribution where each storage location receives only the specific encryption keys necessary for its designated data. This localized approach simplifies access control at each location while minimizing the overall key management workload and preserving system resources for other tasks.
3Device complexity
If key distribution is centralized in large distributed systems, then key management is simplified, but response time and resource availability decrease
Solution Approach 1:
The key distribution service pre-processes key distribution requests by determining appropriate keys and their destinations before actual data access operations. By performing this key determination and distribution preparation in advance, the system reduces the time required during actual data access operations while maintaining centralized management control.
Data Source
AI summary
A distributed data store may implement passive distribution encryption keys to enable access to encrypted data stored in the distributed data store. Keys to encrypt a data volume stored in the distributed data store may be encrypted according to a distribution key and provided to a client of the distributed data store. Storage nodes that maintain portions of the data volume may receive the encrypted key from a client to enable access to the data volume. The storage nodes may decrypt the key according to the distribution key and enable access to the data volume at the storage nodes. In some embodiments, a key hierarchy may be implemented to encrypt the keys that provide access to the encrypted data. The key hierarchy may include a user key.