Selective Encryption Key Map for Tape Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods require encrypting entire volumes of data, leading to inefficiencies such as needing both encrypted and non-encrypted media, increased storage costs, and performance impacts due to encryption and decryption processes.
Innovation Solution
Implementing a key management system that allows selective encryption of specific parts of a volume, enabling both secure and insecure data to be stored on the same media, with encryption controls managed through a key map that specifies encrypted and non-encrypted regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire volume is encrypted, then data security is improved, but storage device complexity and costs increase due to needing both encrypted and non-encrypted media
Solution Approach 1:
The patent divides the storage volume into multiple segments or partitions, where only specific segments containing sensitive data are encrypted while other segments remain unencrypted. This segmentation allows the system to maintain data security for critical information while avoiding the complexity of encrypting the entire volume, thus resolving the contradiction between security and device complexity.
Solution Approach 2:
The patent applies encryption selectively to specific regions or portions of the storage volume based on the sensitivity and security requirements of the data stored in those regions. Rather than uniformly encrypting the entire volume, the system implements local quality control by encrypting only where necessary, thereby improving security for critical data while reducing overall system complexity and costs.
2Reliability
If the entire volume is encrypted, then data security is improved, but processing time increases due to encryption and decryption operations
Solution Approach 1:
By segmenting the storage volume and encrypting only specific segments, the patent reduces the total amount of data that requires encryption and decryption operations. This segmentation approach maintains security for sensitive data while minimizing the time loss associated with cryptographic processing, as only a portion of the total data volume undergoes encryption/decryption cycles.
Solution Approach 2:
The patent applies partial action by encrypting only the necessary portions of data rather than the entire volume. This selective encryption approach provides adequate security for sensitive information while avoiding the excessive processing time that would result from encrypting all data, thus resolving the contradiction between security and processing time.
3Productivity
If selective encryption is implemented, then storage efficiency is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The patent organizes encrypted segments with structured key management, where each segment or partition has its own encryption key. This segmentation approach improves storage efficiency by allowing selective encryption of only necessary data portions, while the systematic organization of keys across segments provides a manageable framework that balances security requirements with operational complexity.
Data Source
AI summary
A data processing system having a host computer including a key manager, a control unit connected to the host computer, a data storage unit (such as a tape drive) controlled by the control unit, and data storage medium for storing data thereon to be written to or read from by the data storage unit. The key manager stores a data structure having at least one record having a volume serial number, as start location, a length entry, and a key for encrypting and decrypting data on the data storage medium. A data storage medium (such as data tape) is mounted on the data storage unit, and a volume recorded on the tape is retrieved. The control unit retrieves the data structure from the key manager and matches the volume serial number recorded in the retrieved data structure with the volume serial number retrieved from the data storage medium. It they match, the control unit passes to the data storage unit, commands to turn on or turn off encryption dependent upon the location where data is written by the data storage unit onto the data storage medium, or to turn on or turn off decryption dependent upon the location where data is read by the data storage unit from the data storage medium.