Selective Data Encryption Storage for Faster Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage methods face challenges in ensuring data security and efficiency, particularly in cloud migration, with large time overheads for encryption and decryption of massive data, leading to reduced read/write efficiency and security risks.
Innovation Solution
A data storage method that selectively encrypts a part of the data in a trusted execution environment (TEE) and stores it in non-volatile memory, while the remaining part is stored in a hard disk or magnetic disk, optimizing encryption duration and ensuring security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entire data is encrypted to ensure security, then data security is improved, but encryption time and processing overhead increase significantly
Solution Approach 1:
The patent divides data into two categories: hot data (frequently accessed) and cold data (infrequently accessed). Only cold data is encrypted and stored in non-volatile memory, while hot data remains unencrypted and accessible in volatile memory. This segmentation resolves the contradiction by applying encryption only where security is critical and access frequency is low, thereby maintaining data security for sensitive information while avoiding encryption overhead for frequently accessed data.
Solution Approach 2:
Different storage locations and encryption levels are applied based on data characteristics. Cold data stored in non-volatile memory receives full encryption protection, while hot data in volatile memory remains unencrypted for rapid access. This local quality approach ensures that encryption is applied precisely where needed (in non-volatile storage for cold data) rather than uniformly across all data, reducing overall encryption time while maintaining security where required.
2Productivity
If data is deduplicated and compressed to control storage costs, then storage efficiency is improved, but the amount of data requiring encryption remains huge and time overheads are large
Solution Approach 1:
The patent segments data based on access patterns into hot and cold categories, and applies different processing strategies. Cold data undergoes deduplication, compression, and encryption before being stored in non-volatile memory. Hot data is kept unencrypted in volatile memory for rapid access. This segmentation reduces the total volume of encrypted data by excluding hot data from encryption, thereby reducing encryption time overhead while maintaining storage efficiency through selective processing.
Solution Approach 2:
Instead of applying full encryption to all data, the patent applies partial encryption only to cold data portions. This partial action approach reduces the scope of encryption operations to only those data segments that require long-term secure storage, significantly reducing encryption time overhead while maintaining storage efficiency through selective application of encryption to the necessary subset of data.
3Reliability
If encryption is applied to all data to ensure security, then data security is improved, but read/write efficiency decreases due to encryption and decryption operations
Solution Approach 1:
The patent segments data into hot and cold categories based on access frequency. Cold data is encrypted and stored in non-volatile memory, while hot data remains unencrypted in volatile memory. This segmentation improves read/write efficiency by eliminating encryption/decryption operations for hot data that requires frequent access, while maintaining security for cold data through encryption in non-volatile storage.
Solution Approach 2:
The patent introduces an intermediary classification mechanism that identifies and separates hot data from cold data based on access patterns. This intermediary classification allows the system to apply different handling strategies: unencrypted rapid access for hot data and encrypted secure storage for cold data, thereby resolving the speed-security tradeoff through intelligent data categorization and differential processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application provide a data storage method and apparatus, a device, and a readable medium. Steps of the method include: first receiving to-be-stored first data; and then encrypting a first data part in the to-be-stored first data, writing an encrypted first data part into a non-volatile memory, and then writing a second data part into a hard disk or a magnetic disk. Compared with encrypting entire data, the method in which a part of data is selected for encryption can greatly shorten encryption duration, and can also ensure security to some extent. According to the method, reliable encryption is implemented on the part of data, and when only a non-encrypted part of the data is obtained, the first data cannot be obtained completely. In addition, because encrypting data of a small amount consumes short time, the method may further enable the data to be quickly read, and therefore an encryption and decryption operation on the data is not perceived by a user basically.