Cloud Comment Encryption via On-Premises Crypto Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based applications face security concerns due to the exposure of user comments stored outside on-premises firewalls, necessitating enhanced encryption and key management to prevent plain text-based attacks and ensure confidentiality.
Innovation Solution
A system employing a migration engine and a crypto server positioned behind a firewall, which performs batch processing to encrypt or decrypt comments based on metadata-generated keys, ensuring secure storage and rotation of encryption keys to maintain security and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If comments are stored in plain text on cloud storage, then accessibility and ease of operation are improved, but security and confidentiality are worsened due to exposure to plain text-based attacks
Solution Approach 1:
The patent extracts the encryption/decryption functionality from the cloud storage system and places it behind the firewall in a dedicated crypto server. This separates the security-critical key management operations from the accessible cloud storage, allowing comments to be stored in encrypted form on the cloud while maintaining secure access through the on-premises crypto infrastructure.
Solution Approach 2:
The patent introduces a migration engine as an intermediary component that operates behind the firewall to handle encryption and decryption operations. This mediator translates between the need for cloud storage accessibility and the requirement for secure encrypted storage, by encrypting comments before cloud storage and decrypting them when accessed, without exposing plain text comments to the cloud environment.
2Object-affected harmful factors
If encryption keys are rotated for all comments, then security is improved, but processing time and system downtime are worsened
Solution Approach 1:
The patent segments the comment storage into multiple encryption key groups, where different comments are encrypted with different keys. This allows selective key rotation to affect only specific groups of comments rather than requiring rotation for all comments, thereby reducing the processing time and downtime associated with key rotation operations.
Solution Approach 2:
The patent implements dynamic key management where the system can adaptively select which encryption keys to rotate based on security requirements and usage patterns. Rather than following a rigid schedule for all keys, the system dynamically determines which key groups need rotation, optimizing the balance between security improvement and minimizing service disruption.
3Productivity
If batch processing is used for comment encryption, then processing efficiency is improved, but complexity of the system architecture is worsened
Solution Approach 1:
The patent merges the migration engine and crypto server functionality into an integrated on-premises component that handles both comment retrieval from cloud storage and encryption/decryption operations. This consolidation simplifies the overall architecture by reducing the number of separate components and interfaces, while still maintaining batch processing capabilities for efficient handling of large volumes of comments.
Data Source
AI summary
Confidentiality and privacy of user comments are preserved by encryption of comments stored on the cloud. A migration engine and a crypto server including an encryption engine, are positioned behind a firewall from the cloud storage. In response to a comment migration instruction (e.g., •onboarding, •offboarding, or •key rotation), the migration engine performs batch processing across the firewall to retrieve a comment and comment metadata from the cloud storage. The migration engine forwards the comment/comment metadata behind the firewall to the crypto server. Based upon the comment metadata, the encryption engine uses a key for encrypting or decrypting the comment. Once encrypted or decrypted, the comment is returned to the migration engine for forwarding across the firewall and storage on the cloud. Encrypting or decrypting comments using a key determined from comment metadata, can impart flexibility to comment migration (e.g., allowing an administrator to selectively rotate compromised or expired keys).