Revocable Stream Cipher Key Rotation Without Data Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large, distributed systems, frequent key rotation in cloud computing environments is challenging due to the need to transmit, decrypt, and re-encrypt data, which is resource-intensive and exposes data if a key is leaked.
Innovation Solution
Implementing revocable stream cipher algorithms to generate intermediate keys that allow data to be re-encrypted under a new key without exposing the unencrypted data or the new key, using a process where an intermediate key is distributed to encrypt data under the new key, reducing the need for extensive data transfer and maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key rotation is implemented in large distributed systems, then security is improved, but processing resources are excessively consumed and data exposure risk increases
Solution Approach 1:
The patent introduces an intermediate key as a mediator between the old encryption key and the new encryption key. This intermediate key enables direct transformation of encrypted data from one key to another without requiring full decryption and re-encryption, thereby reducing processing resources while maintaining security through multiple key layers
Solution Approach 2:
The key rotation process is segmented into distinct phases: the original key encrypts data, an intermediate key transforms the encryption, and a new key provides updated security. This segmentation allows selective application of encryption transformations on specific data portions rather than complete re-encryption of all data
2Reliability
If frequent key rotation is performed, then security is improved, but data transfer and processing time increase
Solution Approach 1:
The intermediate key serves as a time-efficient mediator that enables rapid key rotation by allowing direct encryption transformation. Instead of time-consuming full decryption and re-encryption cycles, the intermediate key facilitates quick transformation of encrypted data blocks, reducing data transfer time and processing delays
Solution Approach 2:
The system applies partial encryption actions by using the intermediate key to transform only the necessary portions of encrypted data during key rotation, rather than requiring complete re-encryption of all data. This partial action approach reduces processing time while maintaining adequate security
3Reliability
If data is decrypted and re-encrypted during key rotation, then key security is improved, but data exposure risk increases
Solution Approach 1:
The intermediate key acts as a protective mediator that enables key rotation without exposing plaintext data. By transforming encrypted data directly through the intermediate key, the system maintains key security while eliminating the data exposure risk inherent in traditional decrypt-re-encrypt processes
Solution Approach 2:
The system preemptively counteracts data exposure risk by using the intermediate key to prevent the need for plaintext exposure during key rotation. The preliminary establishment of the intermediate key creates a secure transformation path that blocks potential exposure vectors before they can occur
4Reliability
If complete re-encryption of all data is performed, then security is improved, but processing complexity and resource consumption increase
Solution Approach 1:
The encryption process is segmented into distinct layers: original key encryption, intermediate key transformation, and new key encryption. This segmentation allows the system to apply only necessary transformation steps rather than complete re-encryption, reducing processing complexity while maintaining security through layered encryption architecture
Solution Approach 2:
The intermediate key simplifies processing complexity by serving as a mediator that handles the transformation logic. Instead of complex re-encryption procedures, the intermediate key enables straightforward transformation of encrypted data, reducing algorithmic complexity while achieving the same security objectives
Data Source
AI summary
Encryption of data across an environment, such as a shared resource environment, can be updated using keys generated using one or more revocable stream cipher algorithms. Data stored in the environment can be encrypted under a first key, or other such secret. When it is desired to update the encryption, a second key can be generated under which the data is to be re-encrypted. Instead of distributing the second key, a revocable stream cipher generator can generate an intermediate key based on the first and second keys, that when processed with the first key will produce the second key. Such an approach enables data to be re-encrypted under the second key without distributing the second key. Further, the unencrypted data will not be exposed in the process. In some embodiments, the re-encryption can be performed on an as-needed basis in order to reduce processing requirements.