Storage Array Snapshot Key ID Embedding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current approaches to managing encrypted data in storage arrays are not scalable and require manual maintenance of lists to track encryption tools and keys, making it difficult for businesses to efficiently recover encrypted snapshots.

Innovation Solution

The method involves generating unique key identifiers embedded within snapshots, allowing quick extraction of key IDs to decrypt data, and using a host key manager to map encryption tools to virtual storage volumes and track corresponding key IDs, enabling secure and efficient data recovery.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If manual lists are used to track encryption tools and keys, then encryption management is possible, but scalability is poor and administrative burden increases

Engineering Contradiction:

ImprovescalabilityVSAvoidadministrative burden

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The storage array automatically generates key identifiers and embeds them in snapshot metadata without requiring manual tracking. The system self-manages the association between encryption keys and snapshots through automated metadata generation and storage, eliminating the need for manual list maintenance by administrators.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Snapshot metadata acts as an intermediary that contains key identifiers, serving as a bridge between encrypted snapshots and the keys needed to decrypt them. This metadata structure automates the tracking function that previously required manual lists, allowing the system to manage encryption keys scalably.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If encryption keys are embedded in snapshots, then data recovery is simplified, but security risks may increase from key exposure

Engineering Contradiction:

Improvedata recovery simplicityVSAvoidkey exposure risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The actual encryption keys are extracted from snapshots and replaced with key identifiers in the metadata. The full keys remain securely stored in the encryption key manager, while only non-sensitive identifiers are embedded in snapshot metadata, enabling recovery without exposing the actual keys.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Key identifiers serve as intermediaries between the encrypted snapshot data and the actual encryption keys. These identifiers are non-sensitive placeholders that enable key retrieval through the encryption key manager without exposing the actual cryptographic keys, thus maintaining security while simplifying recovery operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12197593B2Encryption key enhancement of storage array snapshots

Publication Date: 2025.01.14 DELL PROD LP

AI summary

One or more aspects of the present disclosure relate to enhancing modular device snapshot-to-encryption-key associations. In embodiments, an input/output (IO) workload can be received at a storage array. The IO workload can include an IO request to write encrypted data on the storage array. The IO request's metadata can also be parsed for information such as snap parameters. Further, an encryption key identifier (ID) can be received from a host, and snapshots of a storage unit can be created with the parsed information and the key ID.