Storage Encryption Rotation Using Read and Write I/O
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption key replacement techniques require significant I/O and processing resources, leading to impaired application availability, increased wear on storage devices, and reduced device lifetime.
Innovation Solution
Implement encryption technique rotation using user I/O operations, dividing the process into three time periods: a first period leveraging write requests, a second period leveraging read and write requests, and a third period actively re-encrypting non-re-encrypted sectors, with monitoring to adjust periods based on re-encryption progress.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption key replacement techniques are used, then encryption security is maintained, but I/O resources are significantly consumed and storage device wear increases
Solution Approach 1:
The system performs preliminary actions by setting up encryption technique rotation in advance through I/O operations. Data is encrypted with different encryption techniques at different time periods during the write operation itself, rather than performing bulk re-encryption later. This preliminary encryption during initial write avoids subsequent intensive I/O operations for key replacement.
Solution Approach 2:
The patent implements periodic action by dividing the encryption key rotation into three distinct time periods: first time period uses first encryption technique, second time period uses second encryption technique, and third time period uses third encryption technique. This periodic rotation during normal I/O operations distributes the encryption workload over time rather than concentrating it in a single resource-intensive operation.
2Reliability
If conventional encryption key replacement techniques are used, then encryption security is maintained, but application availability is impaired
Solution Approach 1:
The system performs preliminary encryption actions during the initial write operation. By encrypting data with the appropriate encryption technique for the current time period during the write operation itself, the system avoids subsequent interruptions for bulk re-encryption, thereby maintaining application availability while ensuring encryption security.
Solution Approach 2:
The patent ensures continuity of useful action by integrating encryption technique rotation into normal I/O operations. The encryption process continues uninterrupted during data writes, with the system seamlessly transitioning between different encryption techniques across time periods without stopping application operations or requiring maintenance windows.
3Reliability
If conventional encryption key replacement techniques are used, then encryption security is maintained, but storage device lifetime is reduced
Solution Approach 1:
The system performs preliminary encryption during the initial write operation, encrypting data with the appropriate encryption technique for the current time period. This eliminates the need for subsequent bulk re-encryption operations that would require intensive read-write cycles, thereby reducing wear on storage devices and extending their operational lifetime while maintaining encryption security.
Solution Approach 2:
The patent implements periodic encryption technique rotation that occurs naturally during normal I/O operations rather than through intensive re-encryption cycles. This periodic approach during third time period distributes wear evenly and avoids concentrated stress on storage devices, extending their operational lifetime while maintaining security.
Data Source
AI summary
Techniques are provided for encryption technique rotation using input/output (I/O) operations. One method comprises obtaining an I/O request to write designated data to a storage device, wherein at least some of the existing data stored by the storage device prior to the obtaining is protected using a first encryption technique associated with a first time period; protecting the designated data using a second encryption technique associated with a second time period that is subsequent to the first time period; and writing the protected designated data to a sector of the at least one storage device. The sector may be marked as comprising re-encrypted data. For an I/O request to read data, a determination is made as to whether the requested read data is stored in a sector comprising re-encrypted data; and the requested read data is decrypted using a decryption key obtained based on a result of the determining.