Unified Storage Encryption Key for In-Flight and At-Rest Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods in storage systems face challenges in protecting data both in-flight and at rest, leading to increased complexity, latency, and security risks due to the need for multiple encryption keys and operations across different host systems.
Innovation Solution
A storage system manages a common data encryption key for both data-in-flight and data-at-rest, using a target key management engine to retrieve and encrypt the key with a public-private key pair, allowing seamless encryption and decryption across host systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple encryption keys are used for data-in-flight and data-at-rest protection, then security is improved, but system complexity increases
Solution Approach 1:
The patent combines multiple encryption keys (data encryption key for data-in-flight and key encryption key for data-at-rest) into a single unified key management system. The storage system retrieves both keys from an external key manager and manages them together, eliminating the need for separate key management mechanisms while maintaining security for both data states.
Solution Approach 2:
The storage system implements a universal key management engine that handles multiple types of encryption keys (data encryption keys and key encryption keys) through a single interface. This multi-functional approach allows the same system component to manage different key types used for protecting data in different states (in-flight and at-rest).
2Reliability
If multiple encryption operations are performed for data-in-flight and data-at-rest, then security is improved, but processing latency increases
Solution Approach 1:
The storage system performs preliminary encryption of data using the data encryption key before data leaves the host system (data-in-flight protection). This preliminary action ensures that when data is written to storage, it is already encrypted, eliminating the need for additional encryption operations during the write process and reducing overall latency.
Solution Approach 2:
The patent establishes continuous encryption protection where data is encrypted once using the data encryption key and remains encrypted throughout its lifecycle in storage. The key encryption key provides continuous protection for the data encryption key itself, ensuring uninterrupted security without requiring repeated encryption operations that would increase latency.
Data Source
AI summary
In some examples, a storage system includes a controller to receive a request for a data encryption key from the host system, in response to the request, retrieve, from a key manager system, the data encryption key for the host system, and encrypt the data encryption key retrieved from the key manager system using a first key, to produce an encrypted data encryption key. The controller sends the encrypted data encryption key to the host system, and receives, from the host system, encrypted data encrypted using the data encryption key.