RAID Encryption Key Independence for Data Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in ensuring the reliability and integrity of encrypted data, particularly in scenarios where improper keys are used during encryption or lost during decryption, leading to data unavailability and integrity issues.
Innovation Solution
A redundant storage system is implemented using an array of data storage devices with separate encryption keys for each data member and parity, allowing for recovery from failures by reading and decrypting data from alternative devices and performing parity computations to ensure data integrity and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If data is encrypted using standard encryption modes (CBC or XTS), then data security is improved, but data reliability and integrity become compromised due to key loss or improper key usage
Solution Approach 1:
The patent divides the encrypted data into multiple data members distributed across different storage devices, with each member encrypted using a separate key. This segmentation ensures that loss or corruption of one key does not affect the entire dataset, as recovery can proceed using remaining members and parity information.
Solution Approach 2:
The patent implements preventive measures by storing redundant parity information encrypted with a separate key, and by verifying key integrity before decryption operations. This cushioning approach prepares the system in advance to handle key loss or corruption without compromising data availability.
2Loss of information
If encryption is implemented to protect sensitive data, then confidentiality is improved, but key management complexity increases leading to potential data loss
Solution Approach 1:
The patent segments the key management burden by using multiple separate keys for different data members and parity, rather than relying on a single master key. This distribution reduces the risk associated with key management while maintaining strong confidentiality protection.
Solution Approach 2:
Each data member is encrypted with its own specific key tailored to that portion of data, allowing localized key management and verification. This local quality approach enables independent verification of each key's integrity without affecting other keys or data members.
3Reliability
If parity information is stored to enable recovery from data loss, then data reliability is improved, but storage space requirements increase
Solution Approach 1:
The patent merges the functionality of data storage and parity storage into a unified encrypted storage system. By encrypting both data members and parity information using the same cryptographic framework and distributing them across the same storage array, the system achieves recovery capability without requiring separate dedicated storage infrastructure.
Data Source
AI summary
By placing an encryption function below a RAID function and requiring independence of encryption functionality along the same boundaries of data member independence of the RAID function, failures of the encryption and key management for individual encryption functions can be recovered with the same data rebuild mechanism as the RAID function. For example, in a RAID set of disk drives, each data partition and each parity partition has a respective data encryption key for storing encrypted data or encrypted parity in the partition, and a LUN or logical volume is mapped to a stripe of data partitions and an associated parity partition across the RAID set so that the data rebuild mechanism of the RAID function may recover from a loss of a single data encryption key without compromising security of the LUN or logical volume.