Split-key encryption for multi-device storage security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-device storage enclosures are vulnerable to unauthorized data access due to the ease of removing and replacing storage devices, which allows attackers to bypass device-based security measures and access data stored on these devices.
Innovation Solution
A data security method where a cryptographic key is partitioned into multiple portions, with each portion stored in different active elements within the storage enclosure, requiring all portions to be combined for encryption/decryption operations, thereby ensuring that the storage device can only operate securely when installed in its intended environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If storage devices are made easily removable and replaceable for convenient operation, then ease of operation is improved, but data security deteriorates as attackers can bypass device-based security measures
Solution Approach 1:
The cryptographic key is segmented into multiple portions and distributed across different active elements (storage devices, control board, midplane). This segmentation ensures that no single removable storage device contains the complete key, preventing attackers from accessing encrypted data by simply removing and replacing individual devices. The key portions are stored in locations including the storage device array, control board, and midplane, creating a distributed security architecture.
2Speed
If the complete cryptographic key is stored on the storage device for encryption/decryption operations, then encryption speed is improved, but data security deteriorates as the full key becomes accessible to attackers
Solution Approach 1:
The cryptographic key is divided into multiple portions distributed across different active elements. During encryption/decryption operations, the control board retrieves the necessary key portions from various locations (storage device array, control board memory, midplane), combines them to form the complete key, and performs the cryptographic operations. This approach maintains security by ensuring the complete key never resides permanently in one location, while still enabling fast encryption/decryption when needed.
Solution Approach 2:
The control board acts as an intermediary that combines key portions from different sources and manages the encryption/decryption process. Rather than storing the complete key on the storage device, the control board retrieves key portions, assembles the complete key in its memory, and performs cryptographic operations temporarily. This intermediary approach balances security requirements with performance needs.
Data Source
AI summary
Apparatus and method for data security in a multi-device data storage enclosure. In some embodiments, the storage enclosure has a housing with opposing first and second ends. A plurality of active elements are disposed within the housing including an array of data storage devices, a control board, and an interconnection arrangement which mechanically and electrically interconnects the plurality of storage devices with the control board. A control circuit encrypts user data stored on a selected data storage device using a cryptographic encryption function and an associated cryptographic key. The key is partitioned into a plurality of portions, with each portion stored in a different one of the active elements.