Peer-to-Peer Key Synchronization via Sequence Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual synchronization of encryption keys across multiple security appliances in secure storage systems is difficult and time-consuming, especially when there are thousands of cryptainers managed by a single or multiple lifetime key management (LKM) appliances.
Innovation Solution
A system and protocol for synchronizing objects, such as encryption key objects, between two appliances by assigning sequence numbers and maintaining counts, where differences in counts indicate objects to be transferred during synchronization, ensuring only new or modified objects with higher sequence numbers are exchanged, thereby reducing the need for full data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual synchronization of encryption keys is performed across multiple security appliances, then key consistency is maintained, but the process becomes difficult and time-consuming
Solution Approach 1:
The system performs preliminary actions by maintaining sequence numbers and counts of key objects at each appliance before synchronization occurs. These pre-calculated metrics enable rapid determination of what needs to be synchronized without manual intervention during the actual sync process
Solution Approach 2:
The synchronization mechanism uses feedback from sequence numbers and object counts to automatically determine which key objects need to be transferred. Each appliance reports its current state, and the system uses this feedback to selectively transfer only the necessary objects, eliminating manual synchronization efforts
2Reliability
If all key objects are transferred during synchronization, then complete key consistency is achieved, but data transfer volume increases
Solution Approach 1:
The system extracts only the necessary key objects for synchronization by comparing sequence numbers and counts between appliances. Instead of transferring all key objects, it selectively transfers only those with sequence numbers higher than the peer's count, significantly reducing data transfer volume while maintaining complete key consistency
Solution Approach 2:
The synchronization process performs partial action by transferring only the subset of key objects that are actually needed (those with sequence numbers greater than the peer's count). This partial transfer approach achieves complete consistency without the excessive data transfer that would result from syncing all objects
3Productivity
If sequence numbers are assigned and counts are maintained for selective transfer, then data transfer is optimized, but system complexity increases
Solution Approach 1:
The sequence numbers and counts serve multiple functions: they track the state of key objects, determine synchronization needs, and guide selective data transfer. This multi-functionality reduces the need for separate mechanisms and simplifies the overall protocol despite the enhanced capabilities
Data Source
AI summary
Apparatus and method for synchronizing objects, e, g., encryption key objects, between pairs of appliances, particularly lifetime key management (LKM) appliances. Each LKM has a local sequence counter where increasing sequence numbers are generated and applied to objects. A peer counter is used to indicate the sequence number of an object synchronized from a peer appliance. When two appliances are synchronized, only those new objects with sequence numbers at least equal to or higher than that within the other appliance are transferred. When synchronized to each other, each appliance will have an up-to-date stored set of objects for all of the appliances in the group. Each object has a unique identification number that are compared to eliminate duplicate objects. During synchronization, if unique identification numbers match between a newly received object and a previously stored key, version numbers may be used to determine which object the receiving appliance should store.