Cloud Backup Privacy Enforcement via File Hash Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based security solutions face challenges in protecting user privacy while detecting malware, as they often require unencrypted files for scanning, which can compromise sensitive information, and may not function effectively on devices without security software.
Innovation Solution
A computer-implemented method and system that identifies private files on a client device, encrypts them before backup to the cloud, and enforces security policies using file hashes, allowing for malware detection and mitigation without compromising user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based security solutions scan files for malware, then malware detection capability is improved, but user privacy is compromised due to unencrypted file scanning
Solution Approach 1:
The system performs preliminary encryption of files on the client device before uploading to the cloud. This preliminary action ensures that files are encrypted before the security scanning process, allowing the cloud service to scan encrypted file hashes without accessing plaintext content, thus maintaining both malware detection capability and user privacy.
Solution Approach 2:
The system extracts only the essential scanning information (file hashes) from the encrypted files for security scanning, while keeping the actual file content encrypted and private. This extraction approach allows malware detection through hash comparison without requiring decryption of the actual file contents, resolving the contradiction between scanning effectiveness and privacy protection.
2Reliability
If security software is installed on client devices, then malware detection is improved, but device compatibility and ease of deployment deteriorate due to strict controls preventing scanning
Solution Approach 1:
The system introduces an intermediary encryption layer between the client device and cloud storage. This intermediary mechanism allows files to be encrypted locally using client-side encryption technology, enabling security scanning of encrypted hashes in the cloud without requiring traditional security software installation or permissions on the client device, thus improving both malware detection and device compatibility.
3Loss of information
If files are encrypted before cloud backup, then user privacy is protected, but cloud-based security scanning becomes ineffective
Solution Approach 1:
The system creates a cryptographic copy (hash) of the encrypted file that preserves the essential properties needed for security scanning without requiring access to the original plaintext content. The cloud service scans these cryptographic copies for malware signatures, maintaining security scanning effectiveness while the original encrypted files remain private and secure.
Data Source
AI summary
A computer-implemented method for enforcing privacy in cloud security may include (i) identifying, by a computing device, a set of files in a backup process for a cloud service, (ii) determining, by the computing device, that at least one file in the set of files is a private file, (iii) modifying, by the computing device encrypting the private file, the set of files in the backup process, (iv) completing the backup process for the cloud service with the modified set of files, and (v) enforcing a security policy of the cloud service based on a scan of file hashes. Various other methods, systems, and computer-readable media are also disclosed.