Client Device Encryption for Secure Cloud Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud data storage systems face challenges in securely storing and querying security-sensitive data, such as numerical and textual data, while ensuring compliance with legal regulations and protecting user data from unauthorized access by cloud storage providers.
Innovation Solution
A client device and data storage server system that encrypts plaintext data elements using multiple encryption keys, allowing for range queries by storing encrypted data buckets and message digests in separate tables, enabling secure storage and retrieval of sensitive data while maintaining user control over encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security sensitive data is stored in plaintext in remote data storage servers, then data can be easily queried, but data security is compromised and unauthorized access by cloud storage providers becomes possible
Solution Approach 1:
The patent segments data into multiple subranges, each encrypted with a different encryption key. This allows the system to maintain security by encrypting data while enabling efficient range queries by querying only the relevant encrypted subrange, thus resolving the contradiction between data security and query capability
Solution Approach 2:
The patent changes the encryption parameter by using different encryption keys for different subranges of data. This enables the system to balance security requirements with query efficiency, as the cloud storage provider cannot decrypt any subrange without the corresponding encryption key, yet range queries can be performed by querying the appropriate encrypted subrange
2Reliability
If data is encrypted in remote data storage servers, then data security is improved, but range queries cannot be easily performed on the encrypted data
Solution Approach 1:
By segmenting data into subranges and encrypting each with a different key, the system enables efficient range queries without compromising security. The query process only needs to access the relevant encrypted subrange rather than decrypting and scanning all data, thus maintaining both security and query efficiency
Solution Approach 2:
The patent performs preliminary encryption of data into subranges before storage, organizing the encrypted data in a way that facilitates efficient range queries. This preliminary organization allows the system to maintain security while enabling productive query operations on the encrypted data
3Ease of operation
If cloud storage providers manage and maintain data storage servers, then remote data storage becomes accessible and convenient, but user data may become accessible to the cloud storage provider violating legal regulations
Solution Approach 1:
The patent extracts the encryption keys from the cloud storage provider's control, keeping them exclusively on user client devices. This allows cloud storage providers to manage servers and provide convenient access while ensuring they cannot access encrypted data without the keys, thus maintaining both accessibility and legal compliance
Solution Approach 2:
The encryption keys act as an intermediary between the user data and the cloud storage provider. The keys enable secure encryption/decryption operations while preventing the cloud storage provider from accessing the actual data content, thus resolving the contradiction between convenient cloud storage and legal compliance
Data Source
Figure 1
Figure 2a~2b
Figure 2c
AI summary
The disclosure relates to a client device (110) for storing data (125a) in a database (125) of a data storage server (120). The data comprises data elements, wherein each data element falls within a subrange of a range identified by a subrange identifier. The client device is configured to encrypt the data elements and to send the data, including the cyphertext data elements, to the server. The client device is further configured to encrypt, for each subrange, a subrange data bucket, wherein each subrange data bucket comprises the data elements falling within the respective subrange and the corresponding cyphertext data elements. Moreover, the client device is configured to send, for each subrange, the respective encrypted subrange data bucket and a message digest or the respective encrypted subrange data bucket and a message authentication code, MAC, of the respective subrange identifier to the server for storage in the database.