Sandboxed Execution for Data Storage Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of key rotation in client-side encryption becomes increasingly costly and time-consuming as the amount of encrypted data stored on storage services grows, as it requires significant data exchange between the client and storage systems.
Innovation Solution
Implementing a sandboxed execution environment within the data storage system that allows the client to upload and execute operational instructions for key rotation, reducing the need for data transfer by enabling decryption and re-encryption operations directly on the storage host, using a key management service to manage cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key rotation is performed by retrieving encrypted data from storage service, decrypting with old key, re-encrypting with new key, and transmitting back to storage service, then key rotation can be completed, but data exchange cost and time increase significantly as encrypted data volume grows
Solution Approach 1:
The patent extracts the decryption and re-encryption operations from the client system and relocates them to the storage service. The storage service now performs key rotation operations directly on the encrypted data without requiring the client to retrieve and re-upload the data, thereby eliminating the time-consuming data exchange while maintaining security through server-side cryptographic operations
Solution Approach 2:
The patent introduces a key management service as an intermediary between the client and storage service. This mediator manages cryptographic keys and coordinates the key rotation process, allowing the storage service to perform re-encryption operations using keys provided by the key management service without exposing sensitive cryptographic material to the client
2Reliability
If key rotation is performed by retrieving encrypted data from storage service, decrypting with old key, re-encrypting with new key, and transmitting back to storage service, then key rotation can be completed, but data exchange cost and time increase significantly as encrypted data volume grows
Solution Approach 1:
The patent extracts the computationally intensive decryption and re-encryption operations from the client system and relocates them to the storage service. This redistribution of computational workload reduces the energy consumption at the client end while utilizing the typically more powerful processing resources available at the storage service
3Reliability
If frequent key rotation is performed to increase data security, then security is improved, but the cost and complexity of the rotation process increases
Solution Approach 1:
The patent implements self-service key rotation where the storage service automatically performs decryption and re-encryption operations using keys managed by the key management service. This automation eliminates the need for manual client intervention in the key rotation process, reducing operational complexity while enabling frequent rotation for enhanced security
Solution Approach 2:
The key management service acts as an intermediary that automates key generation, distribution, and rotation coordination. This mediator handles the complexity of key management infrastructure, allowing the storage service to perform frequent key rotations through standardized interfaces without exposing the underlying complexity to clients
Data Source
AI summary
The present document describes a data storage system that includes a sandboxed execution environment. The execution environment is made available to clients of the data storage system. Clients are able to upload executable instructions to the execution environment, which can be used to manipulate data stored on the data storage system. In various examples, clients use the execution environment to perform key rotation operations on encrypted data stored on the data storage system. Clients transfer executable instructions and cryptographic keys to the execution environment, where the encrypted data stored on the data storage system can be read into the execution environment, decrypted with an old key, re-encrypted with a new key, and returned to the data storage system.