Secure Data Storage Device Logging with Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure logging of events in external data storage devices, such as USB drives, is challenging due to the difficulty in implementing a role-based access model across different host computer systems and operating systems, leading to insecure management of access to logs.
Innovation Solution
A data storage device with a non-transitory storage medium and a data store configured to encrypt log entries using public and private keys, with a controller generating and managing these keys to ensure secure access, utilizing elliptic curve cryptography for encryption and decryption, and an access controller to manage access based on device roles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key encryption is used for each log entry, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the logging system into multiple components: a logging public key for encrypting log data, a secret logging key for decryption, and role-based access control. Each log entry is encrypted separately using the logging public key, while the decryption key is protected and only accessible to authorized roles. This segmentation allows strong encryption to be applied only where needed without overwhelming the entire system.
Solution Approach 2:
The patent introduces a role-based access control system as an intermediary layer between the encrypted log data and the decryption process. Instead of allowing direct access to decryption keys, the system uses role verification (administrator, operator, etc.) as a mediator to control who can access the secret logging key. This intermediary layer manages complexity by centralizing access control logic.
2Reliability
If role-based access control is implemented, then access security is improved, but adaptability across different host systems deteriorates
Solution Approach 1:
The patent implements a universal role-based access control system that can function across different host computer systems, operating systems, and data storage devices. The role definitions (administrator, operator, etc.) and access control mechanisms are designed to be platform-independent, allowing the same security model to be applied whether the data storage device is connected to a Windows, Linux, or macOS system. This universality enables consistent security policies while adapting to various host environments.
Data Source
AI summary
This disclosure relates to a data storage device comprising, a non-transitory storage medium configured to store user content data and a non-transitory data store configured to store a first log entry comprising first log data encrypted using one of a first public key and a corresponding first private key; a second public key different from the first public key; and a second log entry. The second log entry comprises the first public key, and second log data encrypted using one of the second public key and a corresponding second private key.