Signature-Based Data Container Recognition for Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In storage systems, managing encryption keys for data containers becomes complex when luns are migrated or restored, leading to potential security compromises, especially in multi-tenant environments where different entities may not have a trust relationship, and storing metadata in arbitrary locations can result in data overwrite.
Innovation Solution
A security appliance generates a signature for each data container by examining its contents, using encrypted data blocks to ensure uniqueness, and associates this signature with an encryption key, storing it in a configuration database or key management system. When data is modified, a new signature is created and updated, allowing the appliance to identify the correct encryption key for access requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are managed manually or stored in arbitrary metadata locations, then key management becomes simple to implement, but security risks increase and data overwrite may occur
Solution Approach 1:
The system enables self-service by having data containers automatically carry their own encryption key identifiers embedded in their signatures. When data containers are created, migrated, or restored, they self-identify their associated encryption keys through signature matching, eliminating the need for external key management tracking and reducing security risks without requiring complex manual management processes.
Solution Approach 2:
The patent introduces an intermediary mechanism - the signature-based identification system that acts as a mediator between data containers and encryption keys. The security appliance uses signatures embedded in data containers to automatically identify and retrieve the correct encryption keys from storage, providing a structured intermediary layer that simplifies key management while enhancing security through automated, error-free key association.
2Quantity of substance
If signatures are generated using unencrypted data blocks, then signature generation is faster and simpler, but uniqueness is compromised when identical plaintext blocks exist
Solution Approach 1:
The system applies parameter changes by transforming the input data for signature generation from unencrypted plaintext to encrypted ciphertext. By changing the state of the data blocks from plaintext to encrypted form before signature generation, the system ensures that identical plaintext blocks produce different signatures based on their unique encryption keys, thereby guaranteeing signature uniqueness without adding significant complexity to the overall process.
Data Source
AI summary
A system and method for signature based data container recognition is provided. When a new data container, such as a lun, is created, a security appliance generates a signature of the data container, by, e.g., examining the contents of one or more data blocks of the data container. The generated signature is then associated with the appropriate encryption key for the data container and is stored either within a configuration database of the security appliance or on a key management system operating within a security appliance environment. To identify the encryption key associated with a data container, the security appliance generates a signature of the data container and compares the generated signature with the stored signatures. Should there be a matching signature, the security appliance utilizes the encryption key associated with the matching signature to process data access requests to/from the data container.