Protected Key Processing for Encrypted Data Compression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods in computing environments restrict storage administrators from performing operations on encrypted data, limiting their ability to back up and restore data due to lack of access to plaintext, thereby hindering efficient data management and storage optimization.
Innovation Solution
A computer program product that utilizes a protected key, created using a system mask, allows a select processor to decrypt and encrypt data on behalf of unauthorized entities, enabling operations like compression and decompression while maintaining data protection, thereby enhancing processing efficiency and storage utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to protect it from unauthorized access, then data security is improved, but the ability to perform operations on the data is worsened
Solution Approach 1:
A trusted processor acts as an intermediary between the encrypted data and the storage administrator. The trusted processor can decrypt the data using protected key material that the administrator cannot access, perform necessary operations on the plaintext data, and re-encrypt the results. This mediator enables operations while maintaining the security model where the administrator never sees the plaintext.
Solution Approach 2:
The system segments the cryptographic operations by separating key management from data processing. The protected key material is stored in a secure key store accessible only to the trusted processor, while the storage administrator has access to encrypted data but not the decryption keys. This segmentation allows different entities to have different levels of access appropriate to their roles.
2Reliability
If storage administrators cannot access plaintext data, then data protection is improved, but data management operations are worsened
Solution Approach 1:
The trusted processor provides self-service capabilities by autonomously performing decryption, operation execution, and re-encryption without requiring the storage administrator to access plaintext data. The processor uses protected key material stored in the secure key store to independently carry out backup, restore, and other management operations on encrypted data.
3Reliability
If operations are performed on encrypted data without decryption, then data security is improved, but processing performance is worsened
Solution Approach 1:
The system dynamically adjusts the security level based on the operation being performed. For operations requiring plaintext processing (like compression or backup), the trusted processor temporarily decrypts the data using protected key material, performs the operation, and then re-encrypts the results. This dynamic approach allows high-performance plaintext operations when necessary while maintaining encrypted storage and transmission.
Data Source
AI summary
A select processor obtains a request to perform a requested operation. The request includes encrypted data and a protected key. The protected key is to be used by the select processor on behalf of an entity unauthorized to use the protected key. The encrypted data is decrypted using the protected key to obtain decrypted data. The requested operation is performed on the decrypted data to obtain resulting data. The resulting data is encrypted (e.g., using the protected key) to obtain encrypted resulting data. The encrypted resulting data is provided to a requestor of the request.