Storage Object Key Derivation for Data-Metadata Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption solutions face challenges in managing multiple encryption keys for data objects in a multi-tenancy environment, leading to security risks and complex key management, especially when a single encryption key is exposed, compromising the security of encrypted data.
Innovation Solution
Generating independent encryption keys for data and metadata using a primary encryption key and unique object identifiers through a one-way function, ensuring each object and its metadata have distinct encryption keys, simplifying key management and reducing exposure risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single encryption key is used for multiple data objects, then key management is simplified, but security is compromised when the key is exposed
Solution Approach 1:
The patent segments the single encryption key into multiple object-specific encryption keys by combining a base encryption key with unique object identifiers through a one-way function. This creates distinct encryption keys for each data object while maintaining a centralized key generation mechanism, thus achieving both security isolation and management simplicity.
2Reliability
If different encryption keys are created for each client's data in a multi-tenancy environment, then security is improved, but key management complexity increases
Solution Approach 1:
The patent implements a universal key generation mechanism that serves multiple functions: it generates unique encryption keys for each object, ensures security isolation between clients, and maintains centralized control through a single base key. This multi-functional approach eliminates the need for separate key management systems while achieving security requirements.
Solution Approach 2:
The system enables self-service key generation where encryption keys are automatically derived from object identifiers using a one-way function. This eliminates manual key management overhead while ensuring each object has its own secure key, reducing complexity in multi-tenancy environments.
3Reliability
If a large number of encryption keys are created for each data object, then security is enhanced, but infrastructure requirements and management difficulty increase
Solution Approach 1:
The patent replaces the mechanical approach of manually managing numerous encryption keys with a cryptographic substitution using a one-way function. This function automatically derives unique keys from object identifiers, eliminating the need for complex key storage infrastructure and manual key management processes while maintaining strong security.
Data Source
AI summary
Aspects of the disclosure generate independent encryption keys for objects (e.g., virtual machine disks (VMDKs)) without requiring the management of multiple keys. An encryption manager obtains a primary encryption key, an object identifier (ID) comprising a globally unique ID (GUID) for an object, a data salt comprising the object ID and a data salt string, and a metadata salt comprising the object ID and a metadata salt string. A data encryption key is generated using the primary encryption key, the data salt, and a one-way function. A metadata encryption key is generated using the primary encryption key, the metadata salt, and the one-way function. Because the data salt string and metadata salt string differ, the data encryption and metadata encryption keys differ. Object IDs for different objects differ, so each object and its metadata have globally unique keys. Key generation (other than the primary key) is deterministic, simplifying key management.