Virtual Disk Selective Encryption Storage Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems lack efficient methods for selectively encrypting confidential data while optimizing the utilization of encrypting and non-encrypting storage disks, leading to suboptimal security and resource utilization in heterogeneous Storage Area Networks (SAN) environments.
Innovation Solution
The implementation of a system that allocates a virtual disk with a predetermined percentage of encrypting and non-encrypting storage disks, allowing applications to dynamically send encryption or non-encryption commands for data access, ensuring confidential data is stored on encrypting disks and non-confidential data on non-encrypting disks, thereby maximizing the use of encrypting disks for secure data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all storage disks are used for encrypting confidential data, then data security is improved, but storage resource utilization deteriorates due to limited encrypting disk capacity
Solution Approach 1:
The virtual disk is segmented into secure extents and non-secure extents, with secure extents mapped to encrypting storage disks for confidential data and non-secure extents mapped to non-encrypting storage disks for non-confidential data. This segmentation allows the system to simultaneously maintain data security for confidential information while maximizing utilization of both encrypting and non-encrypting storage resources.
Solution Approach 2:
Different quality levels of storage are applied to different data types: encrypting storage disks provide enhanced security quality for confidential data, while non-encrypting storage disks provide standard storage quality for non-confidential data. This local quality differentiation ensures that encryption resources are concentrated where needed most while avoiding unnecessary encryption overhead for data that does not require it.
2Quantity of substance
If selective encryption is implemented, then storage resource utilization is improved, but system complexity increases due to management overhead
Solution Approach 1:
A storage controller acts as an intermediary between applications and physical storage disks, managing the complexity of selective encryption automatically. The storage controller receives I/O operations, determines whether data should be encrypted based on metadata tags, and routes operations to appropriate encrypting or non-encrypting storage disks. This intermediary approach shields applications from encryption complexity while maximizing storage resource utilization.
Solution Approach 2:
The system automatically manages encryption selection without requiring application-level intervention. Applications simply tag data as confidential or non-confidential, and the storage system self-manages the encryption routing, key management, and disk selection. This self-service mechanism reduces system complexity by automating what would otherwise require complex coordination between multiple system components.
3Reliability
If encrypting disks are used for all data, then data security is improved, but access speed deteriorates due to encryption overhead
Solution Approach 1:
Instead of applying encryption to all data (excessive action), the system applies encryption only to confidential data (partial action). By using metadata tags to identify confidential data, the system performs encryption selectively, maintaining high security for sensitive information while avoiding encryption overhead for non-confidential data, thus preserving access speed for the majority of storage operations.
Data Source
AI summary
Methods and systems for selective encryption and secured extent quota management for storage servers in cloud computing are provided. A method includes associating at least one secure storage disk and at least one non-secure storage disk to a virtual disk, and associating the virtual disk to an application to allow access of the at least one secure storage disk and the at least one non-secure storage disk. The method further includes accessing the at least one secure storage disk and the at least one non-secure storage disk based on the associating of the virtual disk to the application, to write or read confidential and non-confidential data associated with the application into a respective one of the at least one secure storage disk and the at least one non-secure storage disk.