Virtual Key Management for Column Dataset Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current column-level encryption systems require rewriting all files in a column when a tag change occurs, leading to exponential rewrite operations and significant compute resource usage, along with potential access authorization errors and the need for periodic key preloading.
Innovation Solution
The proposed Key Management System (KMS) virtualizes key creation by decoupling encryption and tagging, using an original key based on the dataset name, column name, and timestamp for encryption, and referencing a tag repository at read time for access control, thereby eliminating the need for immediate re-encryption and key preloading.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If column-level encryption uses separate encryption keys for each column dataset, then access control flexibility is improved, but device complexity and compute resource usage increase due to exponential rewrite operations when tags change
Solution Approach 1:
The patent applies universality by using a single shared encryption key for all column datasets instead of separate keys for each column. This master key approach allows the system to maintain access control flexibility through tag-based policies while eliminating the complexity of managing multiple column-specific keys and performing exponential rewrite operations when tags change.
2Adaptability or versatility
If separate encryption keys are stored for each column, then column-level access control is enabled, but loss of time increases due to periodic key preloading requirements
Solution Approach 1:
The patent eliminates the need for preliminary key preloading by using a shared master key that is already in place for all column datasets. Since the same key is used across all columns, there is no need to pre-load multiple different keys in advance, thereby eliminating time loss associated with key preloading operations.
3Adaptability or versatility
If tag changes occur in column datasets, then access policy updates are enabled, but productivity decreases due to exponential rewrite operations
Solution Approach 1:
The patent resolves the productivity issue by using a universal shared key for all column datasets. When tags change and access policies need to be updated, the system only needs to update the tag metadata rather than performing expensive exponential rewrite operations on the actual data, since the encryption key remains the same across all columns.
4Measurement precision
If multiple tags are associated with datasets, then access control precision is improved, but device complexity increases due to combined key requirements
Solution Approach 1:
The patent applies universality by using a single shared encryption key that works for all column datasets regardless of how many tags are associated with them. This eliminates the need to manage combined keys for multiple tags, thereby maintaining access control precision through tag-based policies while reducing key management complexity to a single key.
Data Source
AI summary
A key management system can store, in a tag repository, information associating policy tags with column datasets. The system can receive a client request for an encrypted encryption key (EEK) to access a column dataset, where the client request includes a column name for the column dataset. Based on the client request, the system can perform a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset. Based on determining that the client device is authorized to access the column dataset, the system can generate an original encryption key, and generate the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset. The system may then provide the EEK to the client device over the one or more networks.