Sectorized Server Data Segmentation for Breach Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large databases storing sensitive information are vulnerable to data breaches due to advanced hacking techniques and insider threats, necessitating a secure storage and retrieval method.
Innovation Solution
The system divides data into segments, encrypts each segment with a unique key, and distributes them across a cluster of sectorized servers, using access keys for secure storage and retrieval, with periodic sector reorganization to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in a centralized database, then data retrieval is efficient and simple, but the system becomes vulnerable to data breaches and hacking attacks
Solution Approach 1:
The patent divides data into multiple segments and stores them across different servers in a cluster. Each segment is encrypted with a unique key, so that compromising one server does not expose the entire dataset. This segmentation approach directly addresses the vulnerability of centralized databases while distributing security risks across multiple independent storage locations.
Solution Approach 2:
The patent implements sectorized servers where different sectors store different types of information (data segments, encryption keys, access control lists). This local differentiation allows the system to apply specific security measures to sensitive elements like encryption keys while storing less sensitive data elsewhere, enhancing overall security without requiring complete system redesign.
2Reliability
If data is encrypted and distributed across multiple servers, then data security is enhanced, but data retrieval becomes more complex and time-consuming
Solution Approach 1:
The patent pre-establishes access control lists and encryption key mappings before data retrieval operations. The system maintains directory structures that map data segments to their encryption keys and access permissions in advance. This preliminary organization allows the system to quickly locate and decrypt required data segments without performing complex security checks during retrieval operations.
Solution Approach 2:
The patent introduces an intermediary component that manages the coordination between multiple encrypted data segments and their corresponding encryption keys. This intermediary handles the complexity of key management and segment reassembly, presenting a simplified interface to users while maintaining robust security protocols in the background.
3Ease of operation
If encryption keys are stored with their corresponding data segments, then data retrieval is simplified, but the system becomes vulnerable if the storage location is compromised
Solution Approach 1:
The patent separates encryption keys from data segments by storing them in different locations within the server cluster. Each data segment is encrypted with a unique key that resides on a different server or in a different sector. This spatial segmentation ensures that compromising one storage location does not provide both the ciphertext and the decryption key, fundamentally preventing trivial decryption attacks.
Solution Approach 2:
The patent extracts encryption keys from their traditional co-location with data and places them in separate secure storage locations. This extraction of the key from the data storage environment creates an additional security layer, requiring attackers to compromise multiple independent systems rather than a single vulnerable point.
Data Source
AI summary
Aspects of the subject disclosure may include, for example, a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations including: dividing data provided for storage into data segments; encrypting each data segment of the data segments with an encryption key, thereby creating encrypted data slices; arranging a cluster of sectorized servers in an ordered list of sectorized servers; selecting a first sectorized server from the ordered list of sectorized servers; generating an access key; and sending a first encrypted data slice of the encrypted data slices and the access key to the first sectorized server, wherein the first sectorized server stores the first encrypted data slice in a sector of the first sectorized server, and retrieves the first encrypted data slice from the sector upon presentation of the access key. Other embodiments are disclosed.