System for encrypted file storage optimization via differentiated key lengths

• US 7,003,116 B2
• Filed: 10/31/2001
• Issued: 02/21/2006
• Est. Priority Date: 10/31/2001
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Riedel, Erik, Swaminathan, Ram, Kallahalla, Mahesh
• Primary Examiner(s): Darrow, Justin T.
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US09/984,936
• Publication Number:
  US 20030086570A1
• Time in Patent Office: 1,574 Days
• Field of Search: 713/201, 713/165, 380/277
• US Class Current: 380/277
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

A key management module is utilized to improve efficiency in cryptographic systems. The key management module may monitor file usage and recommend (and/or implement) key pair changes. In particular, the key management module may be configured to periodically examine (or analyze) performance parameters (e.g., number of times written, number of times read, etc.) associated with a user'"'"'s files. A network monitor module may be configured to gather and maintain records of the associated performance parameters. The key management module may be further configured to compare the performance parameters of a given file with a table of key level ranges. The table of key lengths may be configured to provide a listing of multiple key lengths, each key length corresponding to an activity level of a performance parameter, e.g., relative read/write access frequency. The key management module may recommend changing the relative length of the read and write keys based on the comparison of the performance parameters with the table of key level ranges.

Claims

1. A method for improving storage system efficiency, comprising:

comparing a plurality of performance parameters of a file with a respective plurality of predetermined values; and

modifying a first key of said file in response to one performance parameter of said plurality of performance parameters not matching a respective one predetermined value, wherein said first key is utilized in a security procedure for said file.

2. The method according to claim 1, further comprising:

utilizing said first key of a larger length than a predetermined key length in said security procedure for said file in response to said one performance parameter exceeding said predetermined value.

3. The method according to claim 1, further comprising:

utilizing said first key of a larger length than a predetermined key length in said security procedure for said file in response to said one performance parameter falling below said predetermined value.

4. The method according to claim 1 further comprising:

utilizing said first key of a shorter length than a predetermined key length in said security procedure for said file in response to said one performance parameter falling below said respective predetermined value.

5. The method according to claim 1, further comprising:

utilizing said first key of a shorter length than a undetermined key length in said security procedure for said file in response to said one performance parameter exceeding said respective predetermined value.

6. The method according to claim 1, further comprising

modifying a second key complementary to the first key in response to said modification of said first key, wherein said complementary second key is utilized in said security procedure of said file.

7. The method according to claim 1, wherein said modification of said first key is an increase in a length of said first key.

8. The method according to claim 7, further comprising:

decreasing a length of a second key by a complementary amount of said increase of said length of said first key.

9. The method according to claim 1, wherein said modification of said first key is a decrease in a length of said first key.

10. The method according to claim 9, further comprising:

increasing a length of a second key by a complementary amount of said decrease of said length of said first key.

11. A method for improving efficiency in a cryptographic system, comprising:

comparing a plurality of performance parameters of a file with a respective plurality of predetermined values;

altering a length of a first key in response to one performance factor of said plurality of performance parameters of said tile not matching a respective one of predetermined value; and

altering a length of a second key in response to said alteration of said first key, wherein said first key and said second key are utilized in a security procedure for said file.

12. The method according to claim 11, wherein said alteration of said length of first key is an increase in length and said alteration of length of said second key is a decrease in length.

13. The method according to claim 11, wherein said alteration of said length of first key is a decrease in length and said alteration of length of said second key is an increase in length.

14. A method for improving efficiency in a cryptographic system, comprising:

comparing a plurality of performance parameters of a file with a respective range of plurality of predetermined values;

altering a length of a first key in response to one performance factor of said plurality of performance parameters of said file falling outside a respective range of one predetermined value; and

altering a length of a second key in response to said alteration of said first key, wherein said first key and said second key are utilized in a security procedure for said file.

15. A system for improving storage system efficiency, comprising:

a file system configured to provide access to a plurality of files;

a network monitoring module configured to monitor a plurality of performance factors on said file system; and

a key management module, wherein said key management module is configured to compare said plurality of performance factors with a respective plurality of predetermined values, and is also configured to modify a first key of a file stored on said file system in response to one performance factor of said plurality of performance factors not equaling a respective one predetermined value, wherein said first key is utilized in a security procedure for said file on said file system.

16. The system according to claim 15, wherein said key management node is further configured to re-encrypt said file with said first key of a larger length than a predetermined key length in response to said one performance factor exceeding said respective one predetermined value.

17. The system according to claim 15, wherein said key management node is further configured to re-encrypt said file with said first key of a larger length than a predetermined key length in response to said one performance factor falling below said respective predetermined value.

18. The system according to claim 15, wherein said key management node is further configured to re-encrypt said file with said first key of a smaller length than a predetermined key length in response to said one performance factor exceeding said respective predetermined value.

19. The system according to claim 15, wherein said key management node is further configured to re-encrypt said file with said first key of a smaller length than a predetermined key length in response to said one performance factor falling below said respective predetermined value.

20. The system according to claim 15, wherein said key management node is further configured to modify a second key complementary to the first key in response to said modification of said first key.

21. The system according to claim 15, wherein said modification of said first key is an increase in a length of said first key.

22. The system according to claim 21, wherein key management node is further configured to decrease a length of a second key by an amount of said increase of said first key.

23. The system according to claim 15, wherein said modification of said first key is a decrease in a length of said first key.

24. The system according to claim 23, wherein said key management node is further configured to increase a length of a second key by an amount of said decrease of said first key.

25. The system according to claim 15, further comprising:

a user station; and

a network configured to a communication channel between said file system and said user station, wherein said user station comprises;

at least one processor; and

a memory coupled to said at least one processor, wherein said key management module and network monitoring module reside on said memory and are executed by said at least one processor.

26. A system for improving storage system efficiency, comprising:

a file system configured to provide access to a plurality of files;

a network monitoring module configured to monitor a plurality of performance factors of said plurality of files; and

a key management module, wherein said key management module is configured to complete said plurality of performance factors with a respective plurality of predetermined values, is also configured to alter a length of a first key in response to said one performance factor of said plurality of performance factors not matching a respective one predetermined value, and is further configured to alter a length of a second key in response to said alteration of said first key, wherein said first key end said second key are utilized in a security procedure for said file stored on said file system.

27. The method according to claim 26, wherein said alteration of said length of first key is an increase in length and said alteration of length of said second key is a decrease in length.

28. The method according to claim 26, wherein said alteration of said length of first key is a decrease in length and said alteration of length of said second key is an increase in length.

29. A system for improving storage system efficiency, comprising:

a file system configured to provide access to a plurality of files;

a network monitoring module configured to monitor a plurality of performance factors of said plurality of files; and

a key management module wherein said key management module is configured to compare said plurality of performance factors with a respective range of plurality of predetermined values, is also configured to alter a length of a first key in response to said one performance factor of said plurality of performance factors falling outside a respective range of one predetermined value, and is further configured to alter a length of a second key in response to said alteration of said first key, wherein said first key and said second key are utilized in a security procedure for said file stored on said file system.