Cloud Backup Access Control for Secure Object Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based object storage systems lack mechanisms to ensure the integrity and confidentiality of backup data, as storage administrators can potentially circumvent security measures, compromising the security of backup data stored on third-party cloud-based object storage.
Innovation Solution
Implementing a backup system that acts as an intermediary between the client device and the object storage, leveraging access control functionality and encryption to ensure that only authorized accounts can perform backup operations, with the decryption key controlled by the backup system, thereby preventing unauthorized access and data recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If native security measures are provided by cloud-based object storage, then ease of operation is improved, but security reliability deteriorates because storage administrators can directly access backup data and circumvent security mechanisms
Solution Approach 1:
The backup system acts as an intermediary between client devices and the cloud-based object storage. It implements a backup administrator account that mediates all access to backup data, preventing storage administrators from directly accessing backup data while maintaining operational ease through automated backup operations
Solution Approach 2:
The system segments access controls by creating separate accounts with different permission levels. The backup administrator account has restricted access to backup data only, while the storage administrator account has access to object storage but not backup data, dividing security responsibilities to prevent circumvention
2Ease of operation
If storage administrator accounts are provided with direct access to object storage, then ease of operation is improved, but data integrity deteriorates because backup data can be accessed and manipulated without authorization
Solution Approach 1:
Different quality levels of access are provided to different accounts. The backup administrator account receives restricted access (read-only) to backup data to preserve integrity, while the storage administrator account receives full access to object storage for operational purposes, allowing each to operate effectively within their designated scope
3Reliability
If enhanced security requirements are implemented for backup data, then security reliability is improved, but device complexity increases due to additional access control mechanisms
Solution Approach 1:
The backup system uses universal access control mechanisms that work across both the backup administrator account and storage administrator account. The same object storage infrastructure and account management system are leveraged to enforce enhanced security, avoiding the need for separate complex security systems while maintaining high security reliability
Data Source
AI summary
Described is a system that leverages object storage provided access controls to secure backup data stored on a third-party cloud-based object storage. More particularly, the system may implement a mechanism that ensures that a backup system acts as a gateway for accessing the backup data stored on the object storage. For example, the system may prevent object storage administrative accounts that are authorized to access data directly on the storage from maliciously or inadvertently jeopardizing the integrity of the backup data. Moreover, the backup system may encrypt the backup data to prevent such administrative accounts from performing various backup related operations such as data recovery. Accordingly, to perform backup operations and decrypt the backup data, an account must be authorized by the backup system acting as an exclusive gateway to the backup data stored on a third-party storage.