Local Key Management Using Segmented Random Wrapper Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems using local key management face security vulnerabilities during transportation and assembly, as they lack robust protection against unauthorized access and data decryption without external authentication, particularly when the Random Wrapper Key (RWK) is stored on an unencrypted device.
Innovation Solution
The RWK is divided into an Encrypted RWK (ERWK) stored on the storage system and an Authentication Key Encryption Key (AKEK) stored on an external device, requiring the external device's presence for retrieval and authentication, enhancing security by ensuring only authorized personnel can access and decrypt data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the RWK is stored on the storage system itself for local key management, then the ease of operation is improved, but the security is worsened due to vulnerability during transportation and assembly
Solution Approach 1:
The RWK is segmented into two separate parts: the ERWK stored in the storage system and the AKEK stored on an external device. This segmentation ensures that neither part alone can compromise the entire key, thereby maintaining security while allowing local key management operations to proceed with the ERWK portion.
Solution Approach 2:
An external device serves as an intermediary that securely stores the AKEK portion of the RWK. This intermediary component provides an additional security layer during transportation and assembly, as the AKEK remains protected outside the storage system until authentication is required.
2Reliability
If the RWK is stored externally on a separate device, then the security is improved, but the device complexity is worsened due to requiring external device presence
Solution Approach 1:
The key management functionality is segmented between the storage system (handling ERWK) and an external device (handling AKEK). This segmentation allows the storage system to maintain its core functions while delegating key protection to an external component, reducing the complexity burden on the storage system itself.
Solution Approach 2:
The critical security function of storing the complete RWK is extracted from the storage system and distributed: the ERWK remains in the storage system while the AKEK is extracted and stored externally. This extraction protects the most sensitive portion of the key from being compromised if the storage system is accessed unauthorized.
3Ease of manufacture
If the storage system uses traditional key management without external authentication, then the ease of manufacture is improved, but the security against unauthorized access is worsened
Solution Approach 1:
The key segmentation and external authentication mechanism are established during the manufacturing and initialization phase. The ERWK is generated and stored in the storage system, while the AKEK is securely stored externally before the system enters service. This preliminary setup ensures security is built-in from the start without complicating the manufacturing process.
Solution Approach 2:
An external authentication mechanism is introduced as an intermediary layer between potential unauthorized access and the sensitive data. This intermediary requires additional verification steps that prevent unauthorized access while allowing legitimate operations to proceed normally.
Data Source
AI summary
A data security technique for a data storage system includes in response to connection of an external storage device to a port of the data storage system, retrieving an authentication key encryption key (AKEK) for the data storage system from the external storage device to the data storage system. A random wrapper key (RWK) is generated based on the AKEK and an encrypted random wrapper key (ERWK) for the data storage system (retrieved from a first key repository of the data storage system). The ERWK is retrieved from a first key repository of the data storage system. A master key (retrieved from a second key repository of the data storage system) is decrypted for the data storage system using the RWK. A device access key (DAK) is derived based on the master key. The DAK is used to encrypt/decrypt data for a drive associated with the DAK.