Volume Mirror Data Encryption for Untrusted Plexes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face the risk of data leaks due to unsecured replicated volumes, which can occur when sensitive data is mirrored to untrusted locations, potentially leading to data breaches.
Innovation Solution
A method is introduced to identify non-trusted plexes within replicated volumes, intercept data destined for these plexes, encrypt the data, and write the encrypted data to the non-trusted plexes, while preferring to read from trusted plexes to minimize decryption overhead and optimize I/O response time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is replicated to unsecured locations for redundancy and convenience, then data availability and accessibility are improved, but security risk increases due to possibility of data leaks
Solution Approach 1:
The patent introduces encryption as an intermediary mechanism between the data and the unsecured storage location. The data is encrypted before being written to the non-trusted plex, and decrypted only when read. This intermediary layer of encryption allows the data to be stored in unsecured locations without actually exposing the plaintext data, thus resolving the contradiction between availability and security.
Solution Approach 2:
The patent changes the parameter of data representation from plaintext to encrypted form when storing in non-trusted plexes. This parameter change allows the same data to be stored securely in different locations - unencrypted in trusted locations and encrypted in untrusted locations, maintaining both availability and security across different storage environments.
2Object-affected harmful factors
If data is encrypted before writing to non-trusted plexes, then data security is improved, but I/O response time may increase due to encryption and decryption operations
Solution Approach 1:
The patent applies local quality by differentiating the treatment of data based on the trust level of the storage location. Trusted plexes store data in plaintext for fast access, while non-trusted plexes store encrypted data for security. This localized differentiation allows the system to optimize for both speed (in trusted locations) and security (in untrusted locations) simultaneously, resolving the contradiction between security and performance.
Solution Approach 2:
The encryption operation is performed preliminarily before the data is written to the non-trusted plex. By preparing the encrypted data in advance and using asynchronous replication, the system minimizes the impact on I/O response time while still providing security protection.
3Device complexity
If all plexes are treated equally for read operations, then system simplicity is maintained, but performance deteriorates due to unnecessary decryption operations
Solution Approach 1:
The patent implements local quality by treating different plexes differently based on their trust status. Trusted plexes are used for read operations without decryption overhead, while non-trusted plexes require decryption. This localized differentiation optimizes performance by avoiding unnecessary decryption operations on trusted data while maintaining security on untrusted data, resolving the contradiction between simplicity and performance.
Data Source
AI summary
Various computer-implemented methods for securing data of replicated volumes are disclosed. In one example, an exemplary method for performing such a task may include: 1) identifying a set of plexes of a replicated volume, 2) identifying, within the set of plexes, at least one non-trusted plex, 3) intercepting data to be replicated to the non-trusted plex, 4) encrypting the data to be replicated to the non-trusted plex, and then 5) writing the encrypted data to the non-trusted plex. Various other methods, systems, and computer-readable media are also disclosed.