Redundant Key Management for Data Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring the security and durability of data storage systems, particularly in complex network configurations where data access and storage across multiple geographic boundaries are involved, is challenging due to the need for robust encryption and key management to prevent unauthorized access and data loss.
Innovation Solution
A data storage system employs redundant storage techniques, such as erasure coding, and cryptographic key management using content encryption keys and key encrypting keys, where keys are encrypted and stored with enhanced durability and security measures, including key rotation and disaster recovery mechanisms, to ensure secure and accessible data storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored across multiple geographic boundaries in complex network configurations, then data accessibility and service robustness are improved, but security management complexity and risk of unauthorized access increase
Solution Approach 1:
The patent segments cryptographic key management into distinct components: content encryption keys for data encryption, key encrypting keys for key protection, and disaster recovery keys for backup. This segmentation allows each component to be managed independently across distributed locations, reducing overall security management complexity while maintaining data accessibility across geographic boundaries.
Solution Approach 2:
The patent introduces key encrypting keys as intermediaries between the content encryption keys and the storage system. This intermediary layer enables secure key management across distributed locations by allowing keys to be encrypted and stored separately from the data they protect, simplifying security management in complex network configurations.
2Reliability
If cryptographic keys are encrypted and stored with enhanced durability measures, then data security is improved, but key management complexity and operational overhead increase
Solution Approach 1:
The patent applies preliminary action by encrypting cryptographic keys with key encrypting keys before storage and establishing disaster recovery key pairs in advance. This preliminary encryption and backup setup ensures data security is already in place before any security incident occurs, while the automated key management processes reduce operational overhead despite the enhanced security measures.
Solution Approach 2:
The patent creates encrypted copies of cryptographic keys using key encrypting keys and stores these copies in secure locations. It also creates disaster recovery key pairs as backup copies. This copying approach enhances data security through redundancy while the automated key management system handles the complexity of managing multiple key copies.
3Reliability
If key rotation and disaster recovery mechanisms are implemented, then data protection against unauthorized access and loss is improved, but system complexity and computational overhead increase
Solution Approach 1:
The patent implements periodic key rotation where key encrypting keys are regenerated at scheduled intervals and used to re-encrypt content encryption keys. This periodic action maintains data protection against unauthorized access while the automated rotation process manages system complexity by establishing predictable, recurring operations rather than ad-hoc key management.
Solution Approach 2:
The patent establishes disaster recovery key pairs in advance as a cushion against potential key loss or corruption. These pre-established backup keys provide protection before any disaster occurs, and the automated key management system handles the complexity of maintaining and securing these backup keys, reducing operational burden despite the enhanced protection.
4Reliability
If redundant storage techniques like erasure coding are used, then data durability is improved, but storage overhead and computational resources required increase
Solution Approach 1:
The patent applies segmentation through erasure coding by dividing data into multiple fragments and distributing them across different storage locations. This allows data to be reconstructed from a subset of fragments, improving data durability while reducing storage overhead compared to full redundancy, as not all fragments need to be stored to recover the original data.
Data Source
AI summary
A data storage service redundantly stores data and keys used to encrypt the data. Data objects are encrypted with first cryptographic keys. The first cryptographic keys are encrypted by second cryptographic keys. The first cryptographic keys and second cryptographic keys are redundantly stored in a data storage system to enable access of the data objects, such as to respond to requests to retrieve the data objects. The second cryptographic keys may be encrypted by third keys and redundantly stored in the event access to a second cryptographic key is lost.