Storage Controller Periodic Data Re-encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current storage systems lack efficient mechanisms for periodically re-encrypting user data stored on storage devices, which is essential for maintaining data security and compliance with encryption key lifecycle management.

Innovation Solution

The implementation of a storage system with storage array controllers that periodically re-encrypt user data by detecting expiring data encryption keys, reading encrypted data, re-encrypting it with current keys, and writing it back to the storage device, utilizing a key management module to manage encryption keys and ensure secure data storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data encryption keys are periodically updated to maintain security, then data security is improved, but storage system complexity increases due to key management overhead

Engineering Contradiction:

Improvedata securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The storage device autonomously manages encryption key updates without requiring external intervention. The controller automatically detects expiring keys, generates new keys, and re-encrypts data, allowing the system to serve itself in key management tasks

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs key updates proactively before security vulnerabilities can arise. By monitoring key expiration dates and initiating re-encryption processes in advance, the system maintains continuous security without reactive interruptions

Inventive Principle:

Principle #10Preliminary action

2Reliability

If re-encryption operations are performed frequently to maintain current keys, then encryption key lifecycle compliance is improved, but storage device productivity decreases due to additional read-write operations

Engineering Contradiction:

Improveencryption key lifecycle complianceVSAvoidstorage device throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system implements scheduled, periodic re-encryption operations based on key expiration timelines rather than continuous re-encryption. This allows the storage device to maintain compliance while operating at full capacity during intervals between re-encryption cycles

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The system performs re-encryption operations only when necessary based on key expiration status, avoiding unnecessary full re-encryption cycles. This partial action approach maintains compliance while minimizing impact on storage throughput

Inventive Principle:

Principle #16Partial or excessive action

3Ease of operation

If automatic key detection and re-encryption is implemented, then ease of operation is improved, but device complexity increases due to additional control logic

Engineering Contradiction:

Improveautomatic key managementVSAvoidcontroller logic complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The key management functionality is merged with the existing storage controller operations. The controller integrates key detection, generation, and re-encryption tasks into its existing data processing workflow, avoiding the need for separate dedicated key management hardware or software layers

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12135656B2Re-keying the contents of a storage device

Publication Date: 2024.11.05 PURE STORAGE INC

AI summary

Periodically re-encrypting user data stored on a storage device, including: determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned; re-encrypting the data utilizing a current data encryption key; and writing the data that is encrypted utilizing the current data encryption key to a second location of the storage device.