Rotating Key File System Block Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for changing encryption keys in file systems are inefficient, requiring decryption and re-encryption of all data, which disrupts live traffic and consumes significant resources, leading to less frequent key changes and increased vulnerability to compromise.
Innovation Solution
Implement a rotating key system where multiple data blocks in a file system are encrypted with unique keys, allowing for sequential decryption and re-encryption of each block using a new key, minimizing downtime and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the encryption key is changed frequently to improve security, then the vulnerability to compromise is reduced, but the entire file system data becomes inaccessible for a significant period of time and live traffic is interrupted
Solution Approach 1:
The file system is divided into multiple data blocks, and each block is encrypted with a unique encryption key. This segmentation allows the system to rotate keys at the block level rather than requiring system-wide key rotation, thereby maintaining data accessibility in other blocks during the key rotation process.
Solution Approach 2:
Instead of rotating the encryption key for the entire file system, the patent applies key rotation only to specific data blocks. This partial action approach allows key rotation to occur without affecting the accessibility of other data blocks, thus maintaining overall system productivity while improving security.
2Reliability
If the encryption key is changed frequently to improve security, then the vulnerability to compromise is reduced, but significant processor power and resources are consumed
Solution Approach 1:
By segmenting the file system into multiple data blocks with individual encryption keys, the patent enables key rotation to be performed on only the blocks that require it, rather than processing the entire file system. This significantly reduces the processor power and resources consumed during key rotation operations.
Solution Approach 2:
The patent implements key rotation only for specific data blocks rather than the entire file system. This partial action approach minimizes the computational resources required for key rotation while still achieving the security benefits of frequent key changes.
3Productivity
If the encryption key is changed less frequently to avoid interruption of live traffic and reduce resource consumption, then data accessibility and resource efficiency are maintained, but the vulnerability to compromise of the encryption key and encrypted data is significantly increased
Solution Approach 1:
The file system is segmented into multiple data blocks, each with its own encryption key. This allows the system to perform key rotation on individual blocks without affecting the accessibility of other blocks, enabling more frequent key changes while maintaining data accessibility and minimizing resource consumption.
Solution Approach 2:
The patent applies key rotation only to specific data blocks rather than the entire file system. This partial action approach allows the system to change keys more frequently for security purposes without the need to make the entire file system inaccessible or consume significant processor resources.
4Reliability
If the entire file system data is decrypted and re-encrypted to change the encryption key, then the encryption key can be rotated, but the process is complicated and requires making all encrypted data inaccessible for a significant period of time
Solution Approach 1:
The patent segments the file system into multiple data blocks, each encrypted with a unique key. This segmentation allows key rotation to be performed on individual blocks independently, simplifying the overall key rotation process and eliminating the need to make the entire file system inaccessible.
Solution Approach 2:
Instead of decrypting and re-encrypting the entire file system, the patent applies key rotation only to specific data blocks. This partial action approach significantly reduces the complexity of the key rotation process and allows it to be performed without making all data inaccessible.
Data Source
AI summary
A file system data is divided into two or more data blocks. A unique encryption key is assigned to each data block with the encryption key assigned to each data block being distinct from other encryption keys used to encrypt the other data blocks and each of the data blocks is encrypted using its assigned encryption key. One of the data blocks within the file system is then selected and decrypted using the distinct encryption key assigned to the selected data block and a new encryption key, distinct for the previously assigned encryption key, is assigned to the selected data block and the selected data block is re-encrypted using the new encryption key. This process is then repeated for each data block on a sequential/cyclic and continually rotating basis.