Volume File Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file security mechanisms for computer readable media are inadequate, as standalone applications only encrypt files after they are stored, leaving them vulnerable, and volume-level encryption relies on a single encryption key, compromising security if compromised.
Innovation Solution
Implement a method to determine and manage encryption keys for both volume and file level data, using user access keys to decrypt and encrypt data, and employing recovery keys to secure against key loss, ensuring data is encrypted at both levels and can be decrypted securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If volume level encryption is implemented with a single encryption key, then all data in the volume is protected, but security is compromised if the single encryption key is compromised
Solution Approach 1:
The patent divides the volume into multiple data containers, each encrypted with a different encryption key. This segmentation allows individual containers to be encrypted separately, so that compromise of one key does not affect the security of other containers. The system creates a plurality of data containers within the volume, each with its own encryption key, thereby distributing the security risk across multiple keys rather than relying on a single key for the entire volume.
2Adaptability or versatility
If standalone application encryption is used, then encrypted files can be sent by electronic mail, but non-encrypted original files remain vulnerable on the computer readable medium
Solution Approach 1:
The patent encrypts data at the time of storage in the volume, rather than encrypting only when files are retrieved for external transmission. This preliminary encryption action ensures that data is protected from the moment it is written to storage, eliminating the vulnerability window where unencrypted files exist on the medium. The encryption is applied proactively during the storage process itself, not reactively when files need to be transmitted.
Data Source
AI summary
A method and apparatus for managing encrypted data on a computer readable medium wherein an encryption key is determined for a received quantum of data. The quantum of data is encrypted according to the encryption key at a volume level when the quantum of data comprises volume data. The quantum of data is encrypted according to the encryption key at a file level when the data comprises file data. The encrypted data is then directed to a computer readable medium.