WO2014042512A1 - Management of storage encryption over network-based elastic block store volume - Google Patents

Management of storage encryption over network-based elastic block store volume Download PDF

Info

Publication number
WO2014042512A1
WO2014042512A1 PCT/MY2013/000156 MY2013000156W WO2014042512A1 WO 2014042512 A1 WO2014042512 A1 WO 2014042512A1 MY 2013000156 W MY2013000156 W MY 2013000156W WO 2014042512 A1 WO2014042512 A1 WO 2014042512A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
key
encrypted
encryption key
ebs
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/MY2013/000156
Other languages
French (fr)
Inventor
Chong Seak Sea
Izyani Daud Nor
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Mimos Bhd
Original Assignee
Mimos Bhd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Mimos Bhd filed Critical Mimos Bhd
Publication of WO2014042512A1 publication Critical patent/WO2014042512A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0623—Securing storage systems in relation to content
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]

Definitions

  • the present invention relates to a system and method for managing storage encryption over network-based or cloud based Elastic Block Store (EBS) Volume to provide flexibility and transparency on the encryption algorithm that can be universally acceptable to any provider and user.
  • EBS Elastic Block Store
  • Cloud computing environment has two major types of data storage.
  • the first type of storage is known as Instance Storage, which is non-persistent and data will be loss after an instance termination.
  • the other type is persistent network-based Elastic Block Store (EBS) Volume, which can be attached to any running instances or also can be used as a persistent boot medium.
  • EBS Volumes are off-instance storage that persists independently from the life of Virtual Machine (VM) instance.
  • Elastic Block Store (EBS) provides highly available and highly reliable storage volumes that can be attached to a running VM instance and exposed as a device within the VM instance.
  • EBS is particularly suited for applications that require a database, file system, or access to raw block level storage.
  • EBS also allows user to create storage volumes in any sizes that can be mounted and attached as devices by VM instances.
  • the storage volumes can be mounted on the same VM instance.
  • the storage volumes behave like raw, unformatted block devices and the user is required to supply device names and block device interface.
  • User can create a file system on top of the EBS Volumes, or use them in any other way as a block device (just like a normal hard drive).
  • data stored in cloud computing environment using EBS is not encrypted; the administrator of EBS may possibly view and/or open and/or modify the data contents. Users are not confident to keep important data in the EBS volume due to the low security level.
  • the present invention proposes a system and method to provide confidentiality as only data owner or authorized users are allowed to view the contents in a cloud computing environment.
  • the data which writes to EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk.
  • the encryption key is stored in the key file and said encryption key will be protected by symmetric key provided by the user.
  • this encryption key will be used to decrypt data read from the disk.
  • the encryption data will be decrypted transparently by the system and return to user mode application.
  • the present invention provides a system (100) and a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • One aspect of the present invention provides a system (100) for managing storage encryption over network based Elastic-Block Store (EBS) Volume (118) with at least one user mode (102) and at least one kernel mode (104); said user mode (102) comprising of at least one application (106) and at least one block device (108); said kernel mode (104) comprising of at least one I/O Manager (110) for receiving mounting instruction and presenting decrypted data to requester; at least one crypto kernel module (112) for retrieving encryption key from key file and performing encryption and decryption on data; at least one file system (116) and at least one EBS Volume (118).
  • Another aspect of the present invention provides for a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • the method comprises steps of initializing and configuring EBS Volume (202); mounting encrypted EBS Volume (204); writing data on EBS Volume and encrypting data (206); reading encrypted data from EBS Volume and decrypting said encrypted data (208); and unmounting encrypted EBS Volume (210).
  • the methodology for initializing and configuring EBS Volume further comprises steps for random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system.
  • a further aspect of the present invention provides a further method (300) for initializing and configuring EBS Volume.
  • the said method comprises steps of selecting EBS Volume (302); selecting encryption algorithm (304); loading Encryption Kernel Module (306); generating at least one encryption key (308); storing encryption key file in Virtual Machine (VM) (310); and initializing and formatting EBS Volume (312).
  • the method for generating at least one encryption key further comprises steps of receiving password (P) through user input (402); calculating message digest (H) by hashing received password (P) (404); generating encryption key (R) randomly (406); encrypting encryption key (R ) using message digest (H) to produce encrypted key (EK) (408); and storing the encrypted key into key file (410).
  • Another aspect of the present invention provides a further method (500) for mounting encrypted EBS Volume.
  • the said method comprises steps of sending instruction to I/O Manager (502); retrieving encryption key from key file by Crypto Kernel Module (504); retrieving encryption key from key file (506); and mounting file system (508).
  • the method for retrieving encryption key from key file by Crypto Kernel Module further comprises steps of receiving password (P) through user input (602); calculating message digest (H) by hashing received password (P) (604); reading key file to retrieve encrypted key (EK) (606); retrieving encrypted key (R) using (H) as a symmetric decryption key (608); and forwarding retrieved encryption key (R) to crypto kernel module (610).
  • a further aspect of the present invention provides a further method (700) for writing data on EBS Volume and encrypting data.
  • the said method comprises steps of requesting to write data on EBS Volume (702); performing write system call to I/O Manager (704); forwarding data to crypto kernel module and encrypting data (706); forwarding encrypted data to file system (708); and storing encrypted data on EBS Volume (710).
  • the method for encrypting data forwarded to crypto kernel module further comprises steps of retrieving encryption key (EK) (802); and encrypting data to obtain encrypted data (ED) using EK as a symmetric encryption key (804).
  • Another aspect of the present invention provides a further method for reading encrypted data from EBS Volume and decrypting said encrypted data.
  • the said method comprises steps of requesting to read data from EBS Volume (902); performing read system call to I/O Manager (904); reading data from EBS Volume and decrypting data (906); forwarding decrypted data to I/O Manager (908); and presenting decrypted data to requester (910).
  • the method for decrypting data upon reading data from EBS Volume further comprises steps of retrieving encryption key (EK) (1002); and decrypting data to obtain decrypted data (DD) using EK as a symmetric decryption key (1004).
  • FIG. 1.0 illustrates the block diagram of the system of the present invention.
  • FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume.
  • FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume.
  • FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key.
  • FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume.
  • FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module
  • FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data.
  • FIG. 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module.
  • FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data.
  • FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
  • FIG. 1.0 illustrates the block diagram of the system of the present invention.
  • the system (100) of the present invention manages storage encryption over network based Elastic-Block Store (EBS) Volume (118) with a user mode (102) and a kernel mode (104).
  • EBS Elastic-Block Store
  • the said user mode (102) comprising of an application (106) and a block device (108) and the said kernel mode (104) comprising of Input Output (I/O) Manager (110), a crypto kernel module (112), a file system (116) and a EBS Volume (118).
  • I/O Input Output
  • crypto kernel module 112
  • file system 116
  • EBS Volume 118
  • EBS Volume (118) is an off-instance storage that persists independently from the life of Virtual Machine (VM) instance.
  • EBS provides highly available, highly reliable storage volumes that can be attach to a running VM instance and exposed as a device within the VM instance.
  • EBS is particularly suited for applications that require a database, a file system, or access to raw block level storage.
  • EBS allows user to create storage volumes in any sizes that can be mounted as devices by VM instances. Multiple volumes can be mounted to the same VM instance.
  • the storage volumes behave like raw, unformatted block devices, with user required to supplied device names and a block device interface. User can create a file system on EBS volumes, or use them in any other way as a block device (just like a normal hard drive).
  • the I/O Manager ( 10) of the present invention receives mounting instruction and presents decrypted data to requester while the crypto kernel module (112) retrieves encryption key from key file.
  • the crypto kernel module (112) retrieves encryption key from key file by the following means wherein the said system receives user input (i.e. a password (P)).
  • Key file is read by retrieving the encrypted key (EK) and the encryption key (R) is retrieved using H as a symmetric decryption key. Thereafter, the encryption key (R) is forwarded to the crypto kernel module.
  • FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume
  • FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume
  • FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key.
  • the methodology for managing storage encryption over network based Elastic-Block Store (EBS) Volume is initiated by first initializing and configuring EBS Volume (202) wherein initializing and configuring EBS Volume further comprises random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system.
  • EBS Volume is first selected (202) as a startup to initialize and configure EBS Volume. Thereafter, the encryption algorithm (304) is selected and Encryption Kernel Module is loaded (306) to generate encryption key (308).
  • the encrypted key (ER) will be stored into the key file in the Virtual Machine (310, 410). Thereafter, EBS Volume will be initialized and formatted accordingly (312).
  • FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume
  • FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module.
  • FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data and FIG.
  • 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module.
  • Request to write data on EBS Volume (702) is received and thereafter a write system call is initiated to I/O Manager (704).
  • the encrypted data is forwarded to the file system (708) and store in the EBS Volume (710).
  • FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data
  • FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume.
  • the decrypted data is forwarded to the I/O Manager (908) and said decrypted data (DD) will be presented to the requester. Subsequently, the encrypted EBS Volume (210) can be unmounted from the system if the volumes are not required.
  • the present invention provides management of storage encryption over network-based EBS Volume in which data being encrypted by encryption algorithm.
  • the present invention provides flexibility on encryption algorithm in which the said algorithm is not limited to any provider.
  • the present invention is transparent to user in which the data that is written to the EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk.
  • the present invention allows and re- enforce confidentiality in the EBS Volume by encryption of the data being stored in the data storage and decryption of the encrypted data using correct symmetric key provided by the authorized user during retrieval process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Description

MANAGEMENT OF STORAGE ENCRYPTION OVER NETWORK-BASED ELASTIC
BLOCK STORE VOLUME
FIELD OF INVENTION
The present invention relates to a system and method for managing storage encryption over network-based or cloud based Elastic Block Store (EBS) Volume to provide flexibility and transparency on the encryption algorithm that can be universally acceptable to any provider and user.
BACKGROUND ART
Cloud computing environment has two major types of data storage. The first type of storage is known as Instance Storage, which is non-persistent and data will be loss after an instance termination. The other type is persistent network-based Elastic Block Store (EBS) Volume, which can be attached to any running instances or also can be used as a persistent boot medium. EBS Volumes are off-instance storage that persists independently from the life of Virtual Machine (VM) instance. Elastic Block Store (EBS) provides highly available and highly reliable storage volumes that can be attached to a running VM instance and exposed as a device within the VM instance. EBS is particularly suited for applications that require a database, file system, or access to raw block level storage. EBS also allows user to create storage volumes in any sizes that can be mounted and attached as devices by VM instances. Multiple volumes can be mounted on the same VM instance. The storage volumes behave like raw, unformatted block devices and the user is required to supply device names and block device interface. User can create a file system on top of the EBS Volumes, or use them in any other way as a block device (just like a normal hard drive). At present, data stored in cloud computing environment using EBS is not encrypted; the administrator of EBS may possibly view and/or open and/or modify the data contents. Users are not confident to keep important data in the EBS volume due to the low security level. The present invention proposes a system and method to provide confidentiality as only data owner or authorized users are allowed to view the contents in a cloud computing environment. In the present invention, when the system creates or writes a file to the storage encryption in EBS volume, the data which writes to EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk. The encryption key is stored in the key file and said encryption key will be protected by symmetric key provided by the user. When the correct symmetric key is used to decrypt the encryption key, this encryption key will be used to decrypt data read from the disk. The encryption data will be decrypted transparently by the system and return to user mode application.
The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrate one exemplary technology area where some embodiments described herein may be practice.
SUMMARY OF INVENTION
The present invention provides a system (100) and a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume. One aspect of the present invention provides a system (100) for managing storage encryption over network based Elastic-Block Store (EBS) Volume (118) with at least one user mode (102) and at least one kernel mode (104); said user mode (102) comprising of at least one application (106) and at least one block device (108); said kernel mode (104) comprising of at least one I/O Manager (110) for receiving mounting instruction and presenting decrypted data to requester; at least one crypto kernel module (112) for retrieving encryption key from key file and performing encryption and decryption on data; at least one file system (116) and at least one EBS Volume (118). The at least one crypto kernel module (112) for retrieving encryption key from key file having means for hashing password (P) through user input to obtain symmetric key to decrypt encrypted key from key file; calculate message digest (H) by hashing received password (P); reading key file to retrieve encrypted key (EK); and retrieving encrypted key (R) using H as a symmetric decryption key.
Another aspect of the present invention provides for a method (200) for managing storage encryption over network based Elastic-Block Store (EBS) Volume. The method comprises steps of initializing and configuring EBS Volume (202); mounting encrypted EBS Volume (204); writing data on EBS Volume and encrypting data (206); reading encrypted data from EBS Volume and decrypting said encrypted data (208); and unmounting encrypted EBS Volume (210). The methodology for initializing and configuring EBS Volume further comprises steps for random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system.
A further aspect of the present invention provides a further method (300) for initializing and configuring EBS Volume. The said method comprises steps of selecting EBS Volume (302); selecting encryption algorithm (304); loading Encryption Kernel Module (306); generating at least one encryption key (308); storing encryption key file in Virtual Machine (VM) (310); and initializing and formatting EBS Volume (312). The method for generating at least one encryption key further comprises steps of receiving password (P) through user input (402); calculating message digest (H) by hashing received password (P) (404); generating encryption key (R) randomly (406); encrypting encryption key (R ) using message digest (H) to produce encrypted key (EK) (408); and storing the encrypted key into key file (410).
Another aspect of the present invention provides a further method (500) for mounting encrypted EBS Volume. The said method comprises steps of sending instruction to I/O Manager (502); retrieving encryption key from key file by Crypto Kernel Module (504); retrieving encryption key from key file (506); and mounting file system (508). The method for retrieving encryption key from key file by Crypto Kernel Module further comprises steps of receiving password (P) through user input (602); calculating message digest (H) by hashing received password (P) (604); reading key file to retrieve encrypted key (EK) (606); retrieving encrypted key (R) using (H) as a symmetric decryption key (608); and forwarding retrieved encryption key (R) to crypto kernel module (610).
A further aspect of the present invention provides a further method (700) for writing data on EBS Volume and encrypting data. The said method comprises steps of requesting to write data on EBS Volume (702); performing write system call to I/O Manager (704); forwarding data to crypto kernel module and encrypting data (706); forwarding encrypted data to file system (708); and storing encrypted data on EBS Volume (710). The method for encrypting data forwarded to crypto kernel module further comprises steps of retrieving encryption key (EK) (802); and encrypting data to obtain encrypted data (ED) using EK as a symmetric encryption key (804).
Another aspect of the present invention provides a further method for reading encrypted data from EBS Volume and decrypting said encrypted data. The said method comprises steps of requesting to read data from EBS Volume (902); performing read system call to I/O Manager (904); reading data from EBS Volume and decrypting data (906); forwarding decrypted data to I/O Manager (908); and presenting decrypted data to requester (910). The method for decrypting data upon reading data from EBS Volume further comprises steps of retrieving encryption key (EK) (1002); and decrypting data to obtain decrypted data (DD) using EK as a symmetric decryption key (1004).
The present invention consists of features and a combination of parts hereinafter fully described and illustrated in the accompanying drawings, it being understood that various changes in the details may be made without departing from the scope of the invention or sacrificing any of the advantages of the present invention.
BRIEF DESCRIPTION OF ACCOMPANYING DRAWINGS
To further clarify various aspects of some embodiments of the present invention, a more particular description of the invention will be rendered by references to specific embodiments thereof, which are illustrated in the appended drawings. It is appreciated that these drawings depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail through the accompanying drawings in which: FIG. 1.0 illustrates the block diagram of the system of the present invention.
FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume. FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume.
FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key.
FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume.
FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module
FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data.
FIG. 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module. FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data.
FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
The present invention provides a system and method for managing storage encryption over network-based or cloud based Elastic Block Store (EBS) Volume. Hereinafter, this specification will describe the present invention according to the preferred embodiments. It is to be understood that limiting the description to the preferred embodiments of the invention is merely to facilitate discussion of the present invention and it is envisioned without departing from the scope of the appended claims. Reference is first being made to FIG. 1.0. FIG. 1.0 illustrates the block diagram of the system of the present invention. As illustrated in FIG. 1.0, the system (100) of the present invention manages storage encryption over network based Elastic-Block Store (EBS) Volume (118) with a user mode (102) and a kernel mode (104). The said user mode (102) comprising of an application (106) and a block device (108) and the said kernel mode (104) comprising of Input Output (I/O) Manager (110), a crypto kernel module (112), a file system (116) and a EBS Volume (118).
EBS Volume (118) is an off-instance storage that persists independently from the life of Virtual Machine (VM) instance. EBS provides highly available, highly reliable storage volumes that can be attach to a running VM instance and exposed as a device within the VM instance. EBS is particularly suited for applications that require a database, a file system, or access to raw block level storage. EBS allows user to create storage volumes in any sizes that can be mounted as devices by VM instances. Multiple volumes can be mounted to the same VM instance. The storage volumes behave like raw, unformatted block devices, with user required to supplied device names and a block device interface. User can create a file system on EBS volumes, or use them in any other way as a block device (just like a normal hard drive).
The I/O Manager ( 10) of the present invention receives mounting instruction and presents decrypted data to requester while the crypto kernel module (112) retrieves encryption key from key file. The crypto kernel module (112) retrieves encryption key from key file by the following means wherein the said system receives user input (i.e. a password (P)). The said password is hashed (H=Hash (P)). Key file is read by retrieving the encrypted key (EK) and the encryption key (R) is retrieved using H as a symmetric decryption key. Thereafter, the encryption key (R) is forwarded to the crypto kernel module.
Reference is now being made to FIG. 2.0, FIG. 3.0 and FIG. 4.0 respectively. FIG. 2.0 is a flowchart illustrating the method for managing storage encryption over network based Elastic-Block Store (EBS) Volume while FIG. 3.0 is a flowchart illustrating the method for initializing and configuring EBS Volume and FIG. 4.0 is a flowchart illustrating the method for generating at least one encryption key. The methodology for managing storage encryption over network based Elastic-Block Store (EBS) Volume is initiated by first initializing and configuring EBS Volume (202) wherein initializing and configuring EBS Volume further comprises random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to decrypt data which are decrypted by the system. EBS Volume is first selected (202) as a startup to initialize and configure EBS Volume. Thereafter, the encryption algorithm (304) is selected and Encryption Kernel Module is loaded (306) to generate encryption key (308). The encryption key is generated by the following means wherein the system receives user input (402) (i.e. a password (P)). The said password is hashed (H=Hash (P)). Encryption key (R) is generated randomly (406) and encrypted key (EK) is generated by encrypting randomly generated encryption key (R) using H as a symmetric encryption key (408) (i.e. Encrypted Key (EK)=EncH(R). The encrypted key (ER) will be stored into the key file in the Virtual Machine (310, 410). Thereafter, EBS Volume will be initialized and formatted accordingly (312).
Upon initializing and formatting the EBS Volume, the encrypted EBS Volume (204) is mounted on the system. Reference is now being made to FIG. 5.0 and FIG. 6.0 respectively. FIG. 5.0 is a flowchart illustrating the method for mounting encrypted EBS Volume and FIG. 6.0 is a flowchart illustrating the method for retrieving encryption key from key file by Crypto Kernel Module. The methodology of mounting the encrypted EBS Volume comprises of first sending instruction to the I/O Manager (502). Thereafter, the encryption key is retrieved from the key file by Crypto Kernel Module (504) wherein user input (i.e. password (P)) is received (602) and the said password (P) is hashed (604) (i.e. H= Hash (P)). The key file is read by retrieving the encrypted key (EK) (606) and encryption key (R) is retrieved by using H as a symmetric decryption key (608) (i.e. Encryption Key (R) = DecH (EK)). Thereafter, the retrieved encryption key (R) is forwarded to crypto kernel module (610). Subsequently, the system of the present invention retrieves the encryption key from the key file (506) and mounts the file system (508). Upon mounting the encrypted EBS Volume, data is written on EBS Volume and further data is being encrypted (206). Reference is now being made to FIG. 7.0 and FIG. 8.0 respectively. FIG. 7.0 is a flowchart illustrating the method for writing data on EBS Volume and encrypting data and FIG. 8.0 is a flowchart illustrating the method for encrypting data forwarded to crypto kernel module. Request to write data on EBS Volume (702) is received and thereafter a write system call is initiated to I/O Manager (704). Thereafter, data is forwarded to crypto kernel module and the said data is encrypted (706) by retrieving the encryption key (EK) (802) and data is encrypted to obtain encrypted data (ED) using EK as a symmetric encryption key (804) (i.e. Encrypted Data (ED) = EncEK (data)). The encrypted data is forwarded to the file system (708) and store in the EBS Volume (710).
Reference is now being made to FIG. 9.0 and FIG. 10.0 respectively. FIG. 9.0 is a flowchart illustrating the method for reading encrypted data from EBS Volume and decrypting said encrypted data and FIG. 10.0 is a flowchart illustrating the method for decrypting data upon reading data from EBS Volume. Once the encrypted data is stored in the EBS Volume, the encrypted data will be read from the EBS Volume and said encrypted data will be decrypted accordingly (208). Request to read data from EBS Volume (902) is received and thereafter a read system call is initiated to I/O Manager (904). Thereafter, data will be read from EBS Volume and the said data is decrypted (906) by retrieving the encryption key (EK) (1002) and data is decrypted to obtain decrypted data (DD) using EK as a symmetric decryption key (1004) (i.e. Decrypted Data (DD) = DecEK (ED)). The decrypted data is forwarded to the I/O Manager (908) and said decrypted data (DD) will be presented to the requester. Subsequently, the encrypted EBS Volume (210) can be unmounted from the system if the volumes are not required.
The present invention provides management of storage encryption over network-based EBS Volume in which data being encrypted by encryption algorithm. The present invention provides flexibility on encryption algorithm in which the said algorithm is not limited to any provider. Further, the present invention is transparent to user in which the data that is written to the EBS disk are encrypted transparently with the random generation of encryption key and stored in the disk. The present invention allows and re- enforce confidentiality in the EBS Volume by encryption of the data being stored in the data storage and decryption of the encrypted data using correct symmetric key provided by the authorized user during retrieval process.
The present invention may be embodied in other specific forms without departing from its essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore indicated by the appended claims rather than by the foregoing description. All changes, which come within the meaning and range of equivalency of the claims, are to be embraced within their scope.

Claims

1. A method (200) for managing storage encryption over network based Elastic- Block Store (EBS) Volume, the method comprising steps of:
initializing and configuring EBS Volume (202);
mounting encrypted EBS Volume (204);
writing data on EBS Volume and encrypting data (206);
reading encrypted data from EBS Volume and decrypting said encrypted data (208); and
unmounting encrypted EBS Volume (210)
characterized in that
initializing and configuring EBS Volume further comprises steps for random generation of encryption key wherein said encryption key encrypts data for writing on EBS volume and said encryption key is used to encrypt data which are decrypted by the system.
2. A method (300) according to Claim 2, wherein initializing and configuring EBS Volume further comprises steps of:
selecting EBS Volume (302);
selecting encryption algorithm (304);
loading Encryption Kernel Module (306);
generating at least one encryption key (308);
storing encryption key file in Virtual Machine (VM) (310); and initializing and formatting EBS Volume (312).
3. A method (400) according to Claim 3, wherein generating at least one encryption key further comprises steps of:
receiving password (P) through user input (402);
calculating message digest (H) by hashing received password (P) (404); generating encryption key (R) randomly (406);
encrypting encrypted key (EK) using H as a symmetric encryption key
(408); and
storing the encrypted key into key file (410).
4. A method (500) according to Claim 2, wherein mounting encrypted EBS Volume further comprises steps of:
sending instruction to I/O Manager (502);
retrieving encryption key from key file by Crypto Kernel Module (504); retrieving encryption key from key file (506); and
mounting file system (508).
5. A method (600) according to Claim 5, wherein retrieving encryption key from key file by Crypto Kernel Module further comprises steps of:
receiving password (P) through user input (602);
calculating message digest (H) by hashing received password (P) (604); reading key file to retrieve encrypted key (EK) (606);
retrieving encrypted key (R) using H as a symmetric decryption key (608); and
forwarding retrieved encryption key (R) to crypto kernel module (610).
6. A method (700) according to Claim 2, wherein writing data on EBS Volume and encrypting data further comprises steps of:
requesting to write data on EBS Volume (702);
performing write system call to I/O Manager (704);
forwarding data to crypto kernel module and encrypting data (706);
forwarding encrypted data to file system (708); and
storing encrypted data on EBS Volume (710).
7. A method (800) according to Claim 7, wherein encrypting data forwarded to crypto kernel module further comprises steps of:
retrieving encryption key (EK) (802); and
encrypting data to obtain encrypted data (ED) using EK as a symmetric encryption key (804).
8. A method (900) according to Claim 2, wherein reading encrypted data from EBS Volume and decrypting said encrypted data further comprises steps of:
requesting to read data from EBS Volume (902);
performing read system call to I/O Manager (904); reading data from EBS Volume and decrypting data (906);
forwarding decrypted data to I/O Manager (908); and
presenting decrypted data to requester (910).
9. A method (1000) according to Claim 9, wherein decrypting data upon reading data from EBS Volume further comprises steps of:
retrieving encryption key (EK) (1002); and
decrypting data to obtain decrypted data (DD) using EK as a symmetric decryption key (1004).
10. A system (100) for managing storage encryption over network based Elastic- Block Store (EBS) Volume (118) with at least one user mode (102) and at least one kernel mode (104); said user mode (102) comprising of at least one application (106) and at least one block device (108); said kernel mode (104) comprising of at least one I/O Manager (110) for receiving mounting instruction and presenting decrypted data to requester; at least one crypto kernel module (112) for retrieving encryption key from key file; at least one file system (116) and at least one EBS Volume (118)
characterized in that
the at least one crypto kernel module (112) for retrieving encryption key from key file having means for:
hashing password (P) through user input to obtain symmetric key to decrypt encrypted data from key file;
calculating message digest (H) by hashing received password (P);
reading key file to retrieve encrypted key (EK); and
retrieving encryption key (R) using H as a symmetric
decryption key.
PCT/MY2013/000156 2012-09-11 2013-09-05 Management of storage encryption over network-based elastic block store volume Ceased WO2014042512A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
MYPI2012004046 2012-09-11
MYPI2012004046A MY164087A (en) 2012-09-11 2012-09-11 Management of storage encryption over network-based elastic block store volume

Publications (1)

Publication Number Publication Date
WO2014042512A1 true WO2014042512A1 (en) 2014-03-20

Family

ID=49326825

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/MY2013/000156 Ceased WO2014042512A1 (en) 2012-09-11 2013-09-05 Management of storage encryption over network-based elastic block store volume

Country Status (2)

Country Link
MY (1) MY164087A (en)
WO (1) WO2014042512A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104836656A (en) * 2015-05-08 2015-08-12 厦门大学 Method for storing and transmitting video file

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CLEMENS FRUHWIRTH ET AL: "Secret messages, hard disk encryption with DM-Crypt, LUKS, and cryptsetup", LINUX MAGAZINE, 1 December 2005 (2005-12-01), XP055092966, Retrieved from the Internet <URL:http://www.linux-magazine.com/content/download/62715/485838/version/1/file/Hard_Disk_Encryption_DM-Crypt_LUKS_cryptsetup.pdf> [retrieved on 20131211] *
ERIK PETERSON: "Encrypting your data on Amazon EC2", 26 November 2011 (2011-11-26), pages 1 - 9, XP055066779, Retrieved from the Internet <URL:http://silvexis.com/2011/11/26/encrypting-your-data-on-amazon-ec2/> [retrieved on 20130614] *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104836656A (en) * 2015-05-08 2015-08-12 厦门大学 Method for storing and transmitting video file

Also Published As

Publication number Publication date
MY164087A (en) 2017-11-30

Similar Documents

Publication Publication Date Title
US8369529B1 (en) Re-keying based on pre-generated keys
US9740639B2 (en) Map-based rapid data encryption policy compliance
KR102854455B1 (en) System, apparatus, and method for secure deduplication
US10402109B2 (en) Systems and methods for storing data blocks using a set of generated logical memory identifiers
KR101371608B1 (en) Database Management System and Encrypting Method thereof
US8352751B2 (en) Encryption program operation management system and program
US9774445B1 (en) Host based rekeying
US20080104417A1 (en) System and method for file encryption and decryption
US20230254126A1 (en) Encrypted search with a public key
US7590868B2 (en) Method and apparatus for managing encrypted data on a computer readable medium
US10733306B2 (en) Write-only limited-read filesystem
US10671748B2 (en) Secrets as a service
TW202008744A (en) Dynamic cryptographic key expansion
TW201933169A (en) Managing a set of cryptographic keys in an encrypted system
US12309258B2 (en) Encryption in a distributed storage system utilizing cluster-wide encryption keys
US11720717B2 (en) System memory information protection with a controller
AU2017440029A1 (en) Cryptographic key generation for logically sharded data stores
CN114186245A (en) Encryption key from storage system
US8364979B1 (en) Apparatus, system, and method to efficiently search and modify information stored on remote servers, while hiding access patterns
Sassani et al. Evaluating encryption algorithms for sensitive data using different storage devices
CN103077359B (en) Data decryption method and Apparatus and system
US11283600B2 (en) Symmetrically encrypt a master passphrase key
US9218296B2 (en) Low-latency, low-overhead hybrid encryption scheme
CN120449219A (en) A method for creating an encrypted disk, a method for persistently storing data, and a device
WO2014042512A1 (en) Management of storage encryption over network-based elastic block store volume

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13774528

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13774528

Country of ref document: EP

Kind code of ref document: A1