Client-Side AES Encryption for Secure Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based storage systems face security challenges in protecting data from unauthorized access, with users having limited options to secure data before it is stored, and relying on cloud providers to ensure infrastructure security.
Innovation Solution
Implementing a system where data is encrypted at the source on the client device using Advanced Encryption Standard (AES) and managed through a synchronized storage server, enabling secure sharing and synchronization across devices with per-folder or per-object access control, and encrypting keys for each recipient.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored in cloud-based storage systems, then storage capacity and accessibility are improved, but data security and control over encryption are worsened
Solution Approach 1:
The system performs preliminary encryption of data on the client device before transmission to the cloud storage server. The data is encrypted using AES encryption with keys generated and managed locally on the client device, ensuring that encryption occurs before the data leaves the user's control environment. This preliminary action maintains security while enabling cloud storage accessibility.
Solution Approach 2:
The encryption key is segmented and distributed differently from the encrypted data. The data encryption key is stored separately from the encrypted files on the cloud server, and access control keys are managed independently through an access control list. This segmentation ensures that even if data is accessed, the encryption keys remain protected, maintaining security while allowing cloud-based storage and retrieval.
2Reliability
If data is encrypted at the source on client devices, then data security is improved, but system complexity increases
Solution Approach 1:
The client device automatically performs encryption of data using locally generated keys without requiring manual intervention. The system self-manages the encryption process, key generation, and key storage on the client device. This automation reduces the perceived complexity for users while maintaining strong encryption security.
Solution Approach 2:
The system introduces an intermediary access control mechanism that simplifies key management. An access control list stores encrypted data encryption keys for different folders, and a key encryption key protects these stored keys. This intermediary layer abstracts the complexity of key management from users while maintaining security through cryptographic protection.
3Ease of operation
If encryption keys are stored on cloud servers for access, then data accessibility is improved, but security control is worsened
Solution Approach 1:
The encryption key is segmented into two separate components stored in different locations: the data encryption key is stored on the cloud server within an access control list, while the key encryption key that protects it is stored locally on the client device. This segmentation allows the cloud server to store encrypted data and metadata without having access to the actual encryption keys, maintaining security control while enabling data accessibility through the stored key reference.
Solution Approach 2:
The client device performs preliminary encryption of the data encryption key using the key encryption key before storing it on the cloud server. This preliminary encryption action ensures that even though the key is stored on the cloud server for accessibility, it remains protected by local key management, maintaining security control while enabling future decryption and access.
Data Source
AI summary
This invention includes a synchronized storage server enabled to send the end-point device a notification including the root folder list. The end-point device compares the sent root folder list to a previously stored root folder list in the end-point devices' memory. If the end-point device detects either a new root folder on the synchronized storage server, a change in an existing folder, or deleted content in a folder the end-point device will determine that a change is required to the stored data. Next the end-point device will synchronize with the synchronized storage server and create a new storage list. Finally, the synchronized storage server will send the end-point device a new encrypted folder encryption key which includes the encrypted file contents along with identifying information such as the server name and revision information.