Cloud Data Encryption via Gateway Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing security methods, such as transport security and object security, are inadequate for ensuring data protection and integrity, especially for mobile users, as they lack comprehensive encryption and are vulnerable to legal intercepts, and existing solutions fail to maintain secure key management across different networks.
Innovation Solution
A method and node architecture that encrypts user data with a content key before storing it in the cloud, using a shared secret key stored in both the mobile device and the authentication server, ensuring data remains encrypted throughout transit and storage, and allows for secure decryption only with regenerated keys, preventing unauthorized access and supporting integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If transport security protocols are used to protect data during transport, then data confidentiality during transmission is improved, but data remains unprotected when stored in the cloud and subject to lawful intercept requirements
Solution Approach 1:
The security system is segmented into multiple independent components: transport security layer and object security layer. Each layer handles specific security requirements independently, allowing transport security to protect data during transmission while object security (encryption) protects data at rest in the cloud, and lawful intercept can be applied at the transport layer without compromising object-level security
Solution Approach 2:
An intermediary security gateway is introduced between the mobile device and the cloud network. This gateway applies encryption to data objects before they enter the cloud network, ensuring that even if transport security is compromised or lawful intercept is applied, the encrypted objects remain protected. The gateway acts as a mediator that adds object-level security without interfering with transport security protocols
2Reliability
If object security with encryption is applied to data objects, then data protection during storage is improved, but network operators must still comply with lawful intercept requirements to provide unencrypted content access
Solution Approach 1:
Security functions are segmented between object security (encryption) and transport security (lawful intercept). Encryption is applied at the object level by the security gateway, while lawful intercept capabilities are maintained at the transport layer by network operators, allowing both requirements to coexist independently
Solution Approach 2:
Encryption is applied preliminarily to data objects before they are transmitted to and stored in the cloud network. This preliminary encryption action ensures that data is protected during storage, while transport security protocols handle lawful intercept requirements separately during the transmission phase
3Reliability
If a session key is used to encrypt mobile user content at the gateway, then data encryption during transport is improved, but a continuous session must be maintained for the lifetime of user content
Solution Approach 1:
Encryption keys are generated preliminarily and stored securely in the mobile device before data transmission. This preliminary key generation eliminates the need for continuous session maintenance, as the device can independently encrypt and decrypt data using pre-stored keys without requiring an active connection to the gateway
Solution Approach 2:
The mobile device performs self-service encryption and decryption operations using locally stored keys. This self-service capability allows the device to protect its own data without requiring continuous interaction with the gateway, eliminating the session duration constraint while maintaining strong encryption
4Ease of operation
If the same key is used for all content accessing the cloud through the gateway, then key management is simplified, but content from different users cannot be treated independently
Solution Approach 1:
The key management system is segmented to provide each user with independent encryption keys. Instead of using a single shared key for all users, each user's content is encrypted with their own unique key, ensuring that user content remains independent and secure while the gateway maintains simplified operations through automated key management
Solution Approach 2:
Each user is assigned local quality characteristics in the form of unique encryption keys specific to their content. This local differentiation ensures that content from different users can be treated independently with appropriate security measures, while the gateway maintains ease of operation through automated key distribution and management
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A mobile node, a gateway node and methods are provided for securely storing a content into a remote node. The mobile node, or a gateway node of a network providing access to the mobile node, applies a content key to the content prior to sending the content for storage in the remote node. The content key is generated at the mobile node, based on a random value obtained from an authentication server, or directly at the authentication server if applied by the gateway node. The content key is not preserved in the mobile node or in the gateway node, for security purposes. When the mobile node or the gateway node fetches again the content from the remote node, the same content key is generated again for decrypting the content. The remote node does not have access to the content key and can therefore no read or modify the content.