Random Bit Pattern Wrapped Data Encryption Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face resource-intensive challenges when wrapping secret keys for log files, especially when third-party installations occur without access to end-user's key-encryption keys, particularly on sequential-access storage mediums.
Innovation Solution
A system generates a random bit pattern as a wrapped data-encryption key, which is stored in the data file, allowing for delayed access to the key-encryption key only when needed, reducing resource requirements and enabling secure encryption and decryption operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the secret key is wrapped with the key-encryption key at log file creation time, then the data security is improved, but the resource consumption increases significantly
Solution Approach 1:
The patent generates the data-encryption key in advance and stores it in the log file header without wrapping it at file creation time. The wrapping operation is deferred to when the key is actually needed, avoiding unnecessary resource consumption during initial setup while maintaining security when required.
Solution Approach 2:
The system dynamically determines whether to wrap the key based on actual needs. Instead of statically wrapping the key at creation time, the wrapping operation is performed conditionally only when the key-encryption key is available and needed, making the system adaptable to different operational contexts.
2Reliability
If the secret key is wrapped at log file creation time, then the data security is improved, but the device complexity increases
Solution Approach 1:
The data-encryption key is prepared in advance and stored in the log file header without the complexity of immediate wrapping. The wrapping step is simplified to occur only when needed, reducing the overall system complexity while maintaining security requirements.
3Productivity
If third parties install and configure databases before sending to end-users, then the setup efficiency is improved, but the key management capability deteriorates
Solution Approach 1:
The log file is created with a pre-generated data-encryption key in the header during third-party setup. This allows efficient initial configuration without requiring end-user key-encryption keys, while still enabling proper key management when the file is accessed by authorized users who provide their keys.
Solution Approach 2:
The patent uses an intermediary approach where the log file header contains a placeholder or pre-generated key that can be wrapped later with the end-user's key-encryption key. This intermediary structure allows both efficient third-party setup and proper end-user key management.
4Quantity of substance
If sequential-access storage mediums are used, then the storage cost is reduced, but the key wrapping operation becomes problematic
Solution Approach 1:
The data-encryption key is generated and stored in the sequential-access storage medium during log file creation without requiring immediate wrapping. This preliminary action avoids the problem of needing to perform wrapping operations on sequential-access media, which would be problematic due to the nature of such storage systems.
Data Source
AI summary
One embodiment of the present invention provides a system that facilitates generating random data-encryption keys for data files. During operation, the system receives a command at a computer system to create a data file that may include encrypted data. This data file includes a wrapped data-encryption key to facilitate encrypting and decrypting data. In response to the command, the system generates a bit pattern to be used as the wrapped data-encryption key. Finally, the system creates the data file, which includes the bit pattern as the wrapped data-encryption key.