Segment Reference Filter for Compromised Key File Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current deduplicated storage systems lack an efficient method to identify and prevent access to files impacted by compromised encryption keys, leading to potential data security breaches and lengthy re-encryption processes.
Innovation Solution
A cryptographic key management system that uses a segment reference filter to efficiently identify files referencing compromised key segments, disallowing reads and preventing deduplication until re-encryption with new keys, thereby enhancing security and reducing recovery time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key-based encryption systems are used to secure data at rest, then data confidentiality is maintained, but there is no method to identify files impacted by compromised keys and prevent read operations on them
Solution Approach 1:
The patent implements a segment reference filter that is proactively populated with segments encrypted by compromised keys before any read operations can occur. When a key compromise is detected, the system immediately begins filtering segment references using this pre-populated filter, preventing unauthorized access before it can happen. This preliminary action eliminates the need to reactively scan and identify affected files after a compromise occurs.
Solution Approach 2:
The segment reference filter acts as an intermediary layer between the encrypted segments and the file system. Instead of directly checking each file's encryption status, the system uses this filter as a mediator to intercept and block access to segments encrypted by compromised keys. The filter translates the key compromise information into segment-level filtering rules, providing a bridge between cryptographic key management and file access control.
2Reliability
If all data encrypted with compromised keys is re-encrypted immediately, then data security is restored, but the re-encryption process is extremely time-consuming and resource-intensive
Solution Approach 1:
Instead of re-encrypting all data immediately, the patent implements partial action by using the segment reference filter to block only the specific segments encrypted by compromised keys. This selective approach allows the system to address the security issue with a fraction of the resources and time required for full re-encryption. The filter provides sufficient security protection without requiring the excessive action of re-encrypting every segment in the storage system.
Solution Approach 2:
The patent extracts the security protection function from the re-encryption process itself. Rather than relying on re-encryption as the sole mechanism for restoring security, the system extracts and implements a separate filtering mechanism that provides immediate security protection. This extracted filtering function operates independently and concurrently with any future re-encryption operations, significantly reducing the time-to-security restoration.
3Reliability
If the system scans all files to identify those encrypted with compromised keys, then affected files can be secured, but the scanning process is computationally expensive and slow
Solution Approach 1:
The segment reference filter is pre-populated with segment identifiers encrypted by compromised keys before any scanning or identification processes are needed. This preliminary population allows the system to immediately begin blocking access to affected segments without requiring any computationally expensive scanning operations. The work of identification is performed in advance during key management events, not during security incidents.
Solution Approach 2:
The patent replaces the mechanical scanning and identification process with a hash-based filtering mechanism. Instead of sequentially examining each file and checking its encryption status, the system uses cryptographic hash functions to create a compact filter structure that can be queried in constant time. This substitution transforms an O(n) scanning operation into an O(1) filter lookup operation, dramatically improving response speed.
4Device complexity
If no filtering mechanism is implemented, then the system structure remains simple, but there is no protection against reads of files encrypted with compromised keys
Solution Approach 1:
The segment reference filter implements a thin-layer protection mechanism that adds minimal structural complexity while providing robust security. Rather than implementing a complex multi-layer security architecture, the patent uses a single, elegant filtering layer that operates transparently in the data access path. This thin film of protection is sufficient to block unauthorized access while maintaining system simplicity and performance.
Data Source
AI summary
A method of blocking access to files encrypted with a compromised key by mapping keys and ranges of containers encrypted by the keys. Upon notification that a key is compromised, fencing a container range corresponding to data segments encrypted by the compromised key to prevent deduplication operations on the segments. The method makes a point-in-time copy of the filesystem managing the segments, wherein each file of the file system is represented as tree structure having a root level and other levels. The method iteratively inspects in a level-wise manner, each container in each level of the file trees of the files to identify containers having segments encrypted by the compromised key, and marks files corresponding to the identified containers as not readable to block the access to the files encrypted with the compromised key.