Client-Specified Object Encryption for Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote data storage systems, such as cloud-based providers, face increased security risks as unauthorized access can lead to data theft and tampering, especially when encryption is not client-specified or is tied to a single account key.
Innovation Solution
Implementing client-specified object encryption within a computing environment using remote third-party storage systems, where data objects are encrypted with user-defined keys, and gradually transitioning from relying on cloud storage provider encryption to client-managed encryption, minimizing downtime and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud storage provider encryption is used, then data storage is simplified and managed centrally, but security is reduced because a single compromised account key exposes all data
Solution Approach 1:
The patent segments the encryption key management by assigning a unique encryption key to each object stored in the cloud. Instead of using a single account-level key, each object is encrypted with its own key that is stored only in the client's local key store, not on the cloud server. This segmentation ensures that compromise of one key does not affect other objects.
Solution Approach 2:
The patent introduces a key store as an intermediary component that resides locally on the client device rather than on the cloud server. This key store acts as a mediator between the client application and the encrypted objects in cloud storage, managing the encryption and decryption operations locally while the cloud provider only stores the encrypted data without access to decryption keys.
2Reliability
If client-specified encryption with user-defined keys is implemented, then data security is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The patent implements self-service encryption where the client application automatically generates, manages, and uses encryption keys without requiring manual user intervention. The key store automatically handles key generation, secure storage, and retrieval operations, allowing the system to service itself regarding key management while maintaining strong security.
Solution Approach 2:
The patent performs preliminary key generation and storage actions before data is uploaded to the cloud. Encryption keys are generated and stored in the local key store in advance, so when data needs to be encrypted for upload, the keys are already available. This preliminary action simplifies the encryption process and reduces complexity during actual data operations.
Data Source
AI summary
Example methods and systems disclosed herein facilitate the introduction and use of client-specified object encryption within a computing environment using remote third-party storage systems, where data objects stored on the remote third-party storage systems were previously either stored in unencrypted form or encrypted with a single key tied to an account that owns the data. In some embodiments, the encryption is introduced into the system in gradual stages, so as to minimize or entirely eliminate data availability downtime. In some embodiments, the introduction of client-specified object encryption involves registration of a user function on the third-party storage system, where the user function handles object decryption in response to requests of content consumers for data objects stored by the third-party storage system.