Client Device Encryption for Secure Remote Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote data storage systems, such as cloud storage, pose security risks as security-sensitive data may become accessible to data storage providers, violating user privacy and legal regulations.
Innovation Solution
A client device encrypts security-sensitive data with an encryption key and provides the encrypted data and key identifier to the data storage server, ensuring the data remains encrypted at all times, with only the client able to access and analyze it, and the server unaware of the encryption information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in remote data storage servers, then data can be recovered when removed or corrupted on client device, but security sensitive data may become accessible to data storage provider
Solution Approach 1:
The system performs preliminary encryption of security sensitive data on the client device before transferring to the remote server. This advance action ensures data is encrypted prior to storage, preventing the data storage provider from accessing plaintext security sensitive data while maintaining the ability to recover data through decryption operations.
Solution Approach 2:
The system introduces an intermediary key management mechanism where encryption keys are managed separately from the data storage. The key identifier is stored with the encrypted data, but the actual decryption keys remain controlled by the client device, creating an intermediary layer that enables data recovery while preventing unauthorized access by the data storage provider.
2Object-affected harmful factors
If encryption is applied to security sensitive data before storage, then data security is improved, but data storage and retrieval complexity increases
Solution Approach 1:
The system extracts the encryption key management function from the data storage function. By separating the storage of encrypted data from the management of decryption keys, the system reduces complexity at each endpoint. The client device handles key management while the remote server handles data storage, dividing the overall system complexity into manageable components.
Solution Approach 2:
The system uses a key identifier copy mechanism where instead of storing or transmitting the actual encryption key with the data, only a key identifier is stored. This copying approach allows the system to maintain encryption security while simplifying data storage and retrieval operations, as the actual key material remains separate and secure.
Data Source
AI summary
A client device configured to store data in a database of a data storage server is provided. The data storage server stores security sensitive data in one or more encrypted data structures of the database. The client device is configured to determine whether data to be stored in the database comprises security sensitive data to be stored in an encrypted data structure of the database and to encrypt this security sensitive data with an encryption key. Furthermore, the client device is configured to provide the data, including the encrypted security sensitive data, and an identifier of the encryption key to the server for storing, based on the identifier of the encryption key, the security sensitive data in the encrypted data structure of the database. According to the present disclosure, the security sensitive data which is already encrypted at the client device improves a secure protection of the data.