Multi-tenant Cloud Data Encryption with On-Premises Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of workflows in computing devices poses challenges in efficiently and securely storing and delivering user data across multiple devices without increasing processor, memory, or bandwidth utilization, particularly in multi-tenant environments where data synchronization becomes cumbersome and unreliable.
Innovation Solution
A cloud-hosted service is configured to store encrypted user data, with the encryption key securely stored on-premises, allowing users to access encrypted data through a ticketing system that validates user identity, ensuring secure storage and reduced complexity by offloading data to a public cloud like Citrix or Azure CosmosDB, thereby maintaining data security and reducing on-premises resource load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user data is stored in a file database on enterprise application store servers and replicated using Microsoft Peer Mesh technology, then data availability across servers is improved, but system complexity and reliability deteriorate due to deprecated technology and cumbersome setup
Solution Approach 1:
The patent extracts the user data storage function from the enterprise application store servers and relocates it to a separate cloud-hosted database service. This separation removes the complexity of data replication and synchronization from the original system, allowing servers to focus on their primary function while the cloud service handles data management independently and reliably.
Solution Approach 2:
The patent introduces a cloud-hosted database service as an intermediary between the enterprise application store servers and the user data. This intermediary service provides a simplified interface for data access and eliminates the need for complex peer-to-peer replication mechanisms, reducing system complexity while maintaining data availability.
2Speed
If user data is stored locally on enterprise application store servers, then data access speed is improved, but security against interception deteriorates
Solution Approach 1:
The patent applies encryption to user data before storing it in the cloud-hosted database. This preliminary security action ensures that even if data is intercepted during transmission or access, it remains protected. The encryption is performed in advance, allowing the system to maintain security without compromising the speed of data access operations.
3Ease of operation
If encryption keys are stored with user data in the cloud, then data accessibility is improved, but security deteriorates due to potential cloud service compromise
Solution Approach 1:
The patent segments the encryption key storage from the user data storage by maintaining keys locally on enterprise application store servers while storing encrypted data in the cloud. This segmentation ensures that even if the cloud service is compromised, the encryption keys remain secure locally, preventing unauthorized access to the data while maintaining accessibility through the distributed key storage architecture.
4Object-affected harmful factors
If more processing resources are allocated for data encryption and cloud communication, then data security is improved, but processor and bandwidth utilization increase
Solution Approach 1:
The patent implements encryption on the client side before data is transmitted to the cloud, allowing the system to secure data without requiring additional processing resources at the server level. The cloud-hosted database service simply stores and retrieves the already-encrypted data, minimizing its processing burden and bandwidth requirements while maintaining strong security protection throughout the data lifecycle.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Systems and methods described herein provide access to encrypted user data at a multi-tenant hosted cloud service. The cloud service enrolls a first tenant in the cloud service. The cloud service receives a request for a ticket for a user of the first tenant to access the cloud service. The cloud service communicates a user data access ticket for the user to access a user data service of the cloud service. The cloud service receives a request to store user data of the user. The request includes encrypted user data. The cloud service stores the encrypted user data. The cloud service may provide the encrypted user data to a computing device of the user after validating the user data access ticket received from the computing device. The computing device may decrypt the encrypted user data and identify the data of the user for resources provided by server(s).