Cloud Data Encryption via Synchronization Server Signatures

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Insecure cloud storage systems pose risks of unauthorized access and data tampering, compromising the confidentiality and integrity of data stored on untrusted remote storage mechanisms.

Innovation Solution

A system that encrypts data before uploading to cloud storage, uses a synchronization server to verify and sign commit records, and manages access through digital certificates and access control policies, ensuring secure data synchronization between clients and cloud storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If data is stored on untrusted remote storage mechanisms, then data accessibility and storage capacity are improved, but data confidentiality and integrity are compromised

Engineering Contradiction:

Improvedata accessibilityVSAvoiddata confidentiality

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary encryption of data on the client device before uploading to cloud storage. This advance protective action ensures that data remains confidential even when stored on untrusted remote storage mechanisms, resolving the contradiction between accessibility and confidentiality.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces cryptographic intermediaries including digital signatures, message authentication codes (MACs), and encryption keys that mediate between the client and cloud storage. These intermediaries verify data integrity and maintain confidentiality without preventing accessibility, thus resolving the contradiction.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If data is transmitted to cloud storage, then storage capacity is improved, but data integrity is compromised due to potential tampering

Engineering Contradiction:

Improvestorage capacityVSAvoiddata integrity

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The system implements feedback mechanisms through cryptographic verification. Message authentication codes (MACs) and digital signatures are generated for uploaded data and verified upon retrieval. This feedback loop detects any tampering during transmission or storage, maintaining data integrity while preserving storage capacity benefits.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs preliminary cryptographic hashing and signature generation before data transmission. These preliminary integrity checks are embedded in the uploaded data structure, enabling automatic verification upon retrieval without compromising storage capacity or requiring additional physical security measures.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If encryption is applied to data before upload, then data confidentiality is improved, but computational overhead increases

Engineering Contradiction:

Improvedata confidentialityVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system applies partial encryption by encrypting only the data payload while leaving metadata and structural elements in plaintext. This selective approach maintains data confidentiality for the critical content while reducing computational overhead compared to full-system encryption, thus resolving the contradiction.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The client device performs self-service encryption using locally stored cryptographic keys before data transmission. This eliminates the need for server-side encryption infrastructure, reducing overall system computational overhead while maintaining strong confidentiality through client-side cryptographic processing.

Inventive Principle:

Principle #25Self-service

4Reliability

If digital signatures and verification mechanisms are implemented, then data integrity is improved, but system complexity increases

Engineering Contradiction:

Improvedata integrityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system implements multi-functional cryptographic primitives that simultaneously provide authentication, integrity verification, and data binding. A single message authentication code (MAC) structure performs multiple security functions, reducing the number of separate verification mechanisms needed and thereby lowering system complexity while maintaining strong integrity guarantees.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10445517B1Protecting data in insecure cloud storage

Publication Date: 2019.10.15 OPEN INVENTION NEWTORK LLC

AI summary

The disclosed embodiments provide a system that processes data. The system includes a first client that encrypts a first set of data, uploads the encrypted first set of data to a volume on a cloud storage system, and creates a commit record of the upload. The system also includes a synchronization server that verifies access to the volume by the first client and includes the commit record in a change set containing a set of commit records associated with the volume. The synchronization server also signs the change set and provides the change set for use in synchronizing the upload with a second client.