Storage Service System Encryption via Cryptoprocessor Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Moving large amounts of data, especially petabytes or more, from an external location to a computing resource service provider environment poses significant resource demands for encryption, particularly with existing network attached storage devices, which can compromise data security during transit.
Innovation Solution
A large storage service system is configured with both computation and storage layers, including diskless computation servers and storage servers, utilizing a secure cryptoprocessor for encryption and decryption, and an autonomous communication protocol for secure booting and data management, reducing resource demands at the external location and ensuring data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted at the external location before transmission, then data security during transit is improved, but resource demand for encryption at the external location increases
Solution Approach 1:
The encryption function is extracted from the external location system and relocated to the storage service system. The storage service system includes a computation layer with encryption capabilities that perform the encryption operation, separating the encryption burden from the external location's resource demands while maintaining data security during transmission and storage.
Solution Approach 2:
The storage service system acts as an intermediary between the external location and the computing resource service provider. It receives data from the external location, performs encryption using its own computation resources, and then transmits the encrypted data to the storage system, thereby protecting data security during transit without burdening the external location's resources.
2Reliability
If a large storage service system is used with computation and storage layers, then data security and reduced resource demands are improved, but system complexity increases
Solution Approach 1:
The storage service system is segmented into distinct functional layers: a computation layer responsible for encryption and data processing, and a storage layer responsible for storing encrypted data. This segmentation allows each layer to be optimized independently and simplifies the overall system architecture by clearly defining responsibilities and interfaces between components.
Solution Approach 2:
The computation layer and storage layer are merged into a single integrated storage service system that operates autonomously. The system combines encryption capabilities with storage functionality in one unified platform, reducing the need for separate external encryption systems and simplifying the overall architecture while maintaining data security.
3Reliability
If data is transmitted in encrypted form over the network, then data security is improved, but transmission time and computational overhead increase
Solution Approach 1:
The system performs preliminary actions by establishing secure communication channels and pre-processing data encryption requirements before actual data transmission begins. The storage service system prepares encryption keys and security protocols in advance, allowing for efficient encryption of large data sets without significant delays during the actual transmission process.
Data Source
AI summary
Techniques for storing encrypted data using a storage service system are described herein. A computer system of a computation layer of the storage service system receives an encrypted key manifest, which is then decrypted using a cryptoprocessor of the computer system of the computation layer to produce a partition key. The partition key is then provided to a file system abstraction layer so that, as data is provided to the computation layer for storage, the file system abstraction layer can use the partition key to encrypt data and store the encrypted data in the storage layer.