Encrypted data storage system
An encrypted data storage system includes a storage system that is configured to store encrypted data, and a first client device that is coupled to the storage system. The first client device performs a hash operation on first data to generate a Data Encryption Key (DEK), and uses the DEK to perform a data encryption operation on the first data to generate encrypted first data. The first client device then uses a first Key Encryption Key (KEK) to perform a first key encryption operation on the DEK to generate a first encrypted DEK, associates the first encrypted DEK with the encrypted first data, and transmits the encrypted first data to the storage system for storage.
1. An encrypted data storage system, comprising:
a storage system that is configured to store encrypted data; and
a first client device that is coupled to the storage system, wherein the first client device is configured to:
perform a hash operation on first data that is included in a first data class in order to generate a first Data Encryption Key (DEK);
perform, using the first DEK, a data encryption operation on the first data to generate encrypted first data;
perform, using a first Key Encryption Key (KEK) that is associated with the first data class, a first key encryption operation on the first DEK to generate a first encrypted DEK;
associate the first encrypted DEK with the encrypted first data;
transmit, to the storage system for storage, the encrypted first data;
perform the hash operation on second data that is included in a second data class in order to generate a second DEK;
perform, using the second DEK, a data encryption operation on the second data to generate encrypted second data;
perform, using a second KEK that is associated with the second data class, a second key encryption operation on the second DEK to generate a second encrypted DEK;
associate the second encrypted DEK with the encrypted second data;
transmit, to the storage system for storage, the encrypted second data; and
determine that the first data class should be cryptoshredded and, in response, delete the first KEK to prevent the first client device from accessing the encrypted first data stored on the storage system.
2. The system of claim 1 , wherein the system further comprises:
a second client device that is coupled to the storage system, wherein the second client device is configured to:
perform the hash operation on the first data to generate the first DEK;
perform, using the first DEK, the data encryption operation on the first data to generate the encrypted first data;
perform, using a third KEK that is different than the first KEK, a third key encryption operation on the first DEK to generate a third encrypted DEK;
associate the third encrypted DEK with the encrypted first data;
transmit, to the storage system for storage, the encrypted first data; and
access, using the third KEK and subsequent to the first client device deleting the first KEK to prevent the first client device from accessing the encrypted first data, the encrypted first data.
3. The system of claim 2 , wherein each of the first client device and the second client device is configured to:
perform the hash operation on the first data and a secret value that is shared between the first client device and the second client device to generate the first DEK.
4. The system of claim 1 , wherein the associating the first encrypted DEK and the encrypted first data includes:
transmitting, to the storage system for storage along with the encrypted first data, the first encrypted DEK as metadata for the encrypted first data.
5. The system of claim 1 , wherein the first client device is configured to:
receive, from the storage system, the encrypted second data;
identify, based on the association of the second encrypted DEK and the encrypted second data, the second KEK;
perform, using the second KEK, a first key decryption operation on the second encrypted DEK to access the DEK; and
perform, using the DEK, data decryption operations on the encrypted second data to access the second data.
6. The system of claim 1 , wherein the first client device is configured to:
perform the second key encryption operation on the DEK to generate the second encrypted DEK using the second KEK and a third KEK.
7. The system of claim 6 , wherein the second KEK is unique to the first client device, and the third KEK is a time-based KEK.
8. An Information Handling System (IHS), comprising:
a processing system including at least one hardware processor; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a client engine that is configured to:
perform a hash operation on first data that is included in a first data class in order to generate a first Data Encryption Key (DEK);
perform, using the first DEK, a data encryption operation on the first data to generate encrypted first data;
perform, using a first Key Encryption Key (KEK) that is associated with the first data class, a first key encryption operation on the first DEK to generate a first encrypted DEK;
associate the first encrypted DEK with the encrypted first data;
transmit, to a storage system for storage, the encrypted first data;
perform the hash operation on second data that is included in a second data class in order to generate a second DEK;
perform, using the second DEK, a data encryption operation on the second data to generate encrypted second data;
perform, using a second KEK that is associated with the second data class, a second key encryption operation on the second DEK to generate a second encrypted DEK;
associate the second encrypted DEK with the encrypted second data;
transmit, to the storage system for storage, the encrypted second data; and
determine that the first data class should be cryptoshredded and, in response, delete the first KEK to prevent the first client device from accessing the encrypted first data stored on the storage system.
9. The IHS of claim 7 , wherein the client engine that is configured to:
perform the hash operation on the first data and a shared secret value to generate the first DEK.
10. The IHS of claim 7 , wherein the associating the first encrypted DEK and the encrypted first data includes:
transmitting, to the storage system for storage along with the encrypted first data, the first encrypted DEK as metadata for the encrypted first data.
11. The IHS of claim 7 , wherein the client engine is configured to:
receive, from the storage system, the encrypted second data;
identify, based on the association of the second encrypted DEK and the encrypted second data, the second KEK;
perform, using the second KEK, a first key decryption operation on the second encrypted DEK to access the DEK; and
perform, using the DEK, data decryption operations on the encrypted second data to access the second data.
12. The IHS of claim 7 , wherein the client engine is configured to:
perform the second key encryption operation on the DEK to generate the second encrypted DEK using the second KEK and a third KEK.
13. The IHS of claim 12 , wherein the second KEK is unique to the client engine, and the third KEK is a time-based KEK.
14. A method for storing encrypted data, comprising:
performing, by a first client device, a hash operation on first data that is included in a first data class in order to generate a first Data Encryption Key (DEK);
performing, by the first client device using the first DEK, a data encryption operation on the first data to generate encrypted first data;
performing, by the first client device using a first Key Encryption Key (KEK) that is associated with the first data class, a first key encryption operation on the first DEK to generate a first encrypted DEK;
associating, by the first client device, the first encrypted DEK with the encrypted first data;
transmitting, by the first client device to a storage system for storage, the encrypted first data;
performing, by the first client device, the hash operation on second data that is included in a second data class in order to generate a second DEK;
performing, by the first client device using the second DEK, a data encryption operation on the second data to generate encrypted second data;
performing, by the first client device using a second KEK that is associated with the second data class, a second key encryption operation on the second DEK to generate a second encrypted DEK;
associating, by the first client device, the second encrypted DEK with the encrypted second data;
transmitting, by the first client device to the storage system for storage, the encrypted second data; and
determining, by the first client device, that the first data class should be cryptoshredded and, in response, deleting the first KEK to prevent the first client device from accessing the encrypted first data stored on the storage system.
15. The method of claim 14 , further comprising:
performing, by a second client device, the hash operation on the first data to generate the first DEK;
performing, by the second client device using the first DEK, the data encryption operation on the first data to generate the encrypted first data;
performing, by the second client device using a third KEK that is different than the first KEK, a third key encryption operation on the first DEK to generate a third encrypted DEK;
associating, by the second client device, the third encrypted DEK with the encrypted first data;
transmitting, by the second client device to the storage system for storage, the encrypted first data; and
accessing, by the second client device using the third KEK and subsequent to the first client device deleting the first KEK to prevent the first client device from accessing the encrypted first data, the encrypted first data.
16. The method of claim 15 , further comprising:
performing, by the first client device, the hash operation on the first data and a shared secret value to generate the first DEK.
17. The method of claim 14 , wherein the associating the first encrypted DEK and the encrypted first data includes:
transmitting, by the first client device to the storage system for storage along with the encrypted first data, the first encrypted DEK as metadata for the encrypted first data.
18. The method of claim 14 , further comprising:
receiving, by the first client device from the storage system, the encrypted second data;
identifying, by the first client device based on the association of the second encrypted DEK and the encrypted second data, the second KEK;
performing, by the first client device using the second KEK, a first key decryption operation on the second encrypted DEK to access the DEK; and
performing, by the first client device using the DEK, data decryption operations on the encrypted second data to access the second data.
19. The method of claim 14 , further comprising:
performing, by the first client device, the second key encryption operation on the DEK to generate the second encrypted DEK using the second KEK and a third KEK.
20. The method of claim 19 , wherein the second KEK is unique to the first client device, and the third KEK is a time-based KEK.