Per-Volume Tenant Encryption with External Key Manager
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems face challenges in securely managing and encrypting data across multiple clients and tenants, with existing encryption methods often using the same keys for different users, leading to potential security breaches and inefficient data distribution across storage media.
Innovation Solution
Implementing per-volume tenant encryption and external key managers that compress, encrypt, and hash data to create unique block identifiers, allowing for secure and customizable data storage across various storage types, including SSDs and spinning disks, while dissociating encryption from client metadata and using tweak values for enhanced security and de-duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the same encryption key is used for different users in current storage systems, then data storage is simplified, but security is compromised leading to potential security breaches
Solution Approach 1:
The patent segments the encryption key management by creating separate encryption keys for each tenant and volume. The key manager generates and manages unique encryption keys (e.g., key1 for tenant1/volume1, key2 for tenant2/volume2) instead of using a single shared key. This segmentation ensures that compromise of one key does not affect other tenants' data security.
Solution Approach 2:
The patent applies local quality by making encryption keys specific to each tenant and volume rather than uniform across the system. Each tenant-volume combination has its own encryption key properties, allowing customized security levels and key management policies for different tenants while maintaining system-wide security.
2Reliability
If data is encrypted without per-volume tenant encryption, then storage and retrieval is faster, but data security across multiple tenants is compromised
Solution Approach 1:
The patent segments encryption operations by tenant and volume, applying encryption only where needed for multi-tenant isolation. The system encrypts data at the volume level with tenant-specific keys rather than requiring encryption for all operations, balancing security requirements with performance needs.
Solution Approach 2:
The key manager acts as an intermediary that handles encryption key generation, storage, and management. It mediates between the storage system and security requirements, providing encrypted data access to authorized tenants while maintaining security without requiring complex encryption logic in the storage paths themselves.
3Reliability
If encryption keys are managed centrally without external key manager, then system complexity is reduced, but security control and flexibility are limited
Solution Approach 1:
The patent extracts key management functionality into a separate external key manager component. This extraction allows the key manager to be independently configured, updated, and secured without affecting the core storage system. The key manager handles key generation, rotation, and lifecycle management separately from data storage operations.
Solution Approach 2:
The external key manager serves as an intermediary layer between the storage system and security requirements. It provides centralized key control and management capabilities while allowing the storage system to focus on data operations. The key manager mediates all encryption-related operations, providing flexibility and security control.
4Reliability
If data is not compressed and encrypted before storage, then storage capacity is maximized, but data security and integrity are compromised
Solution Approach 1:
The patent applies preliminary action by compressing and encrypting data before it is written to storage media. The compression reduces data size, and the encryption with tenant-specific keys secures the data. This preliminary processing ensures that data is stored in an optimized and secure state, preventing unauthorized access and reducing storage requirements.
Data Source
AI summary
A server node with one or more processors is configured to receive a request to write data to a storage medium and compress the data to yield compressed data. The one or more processors are further configured to encrypt the compressed data according to an encryption key to yield compressed and encrypted data. The one or more processors are further configured to hash the compressed and encrypted data to yield one or more block identifiers that uniquely represent the compressed and encrypted data.