Cloud Data Encryption Key Segmentation for Privileged Access Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data security methods for data at rest, such as encryption, are inadequate in protecting against remote privileged access and lack of application security, requiring additional measures beyond mere encryption for comprehensive protection.

Innovation Solution

A method involving the use of a customer master key (CMK) and key encryption key (KEK) management, where the KEK is encrypted and stored separately, with a data key (DK) randomly generated for encrypting and decrypting data, ensuring data remains encrypted during storage and retrieval, and enabling transportable backups with encrypted database master keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data encryption is implemented for data at rest, then data security is improved, but protection against remote privileged access and application security breaches remains insufficient

Engineering Contradiction:

Improvedata securityVSAvoidvulnerability to remote privileged access

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The encryption system is segmented into multiple independent components: data keys for encrypting data, key encryption keys for encrypting data keys, and customer master keys for managing key encryption keys. This segmentation ensures that compromising one component does not compromise the entire system, as each layer provides independent security protection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary encryption actions by encrypting data keys with key encryption keys before storing them, and encrypting key encryption keys with customer master keys before storage. This preliminary encryption ensures that even if data is accessed unauthorizedly, the encryption keys required to decrypt it remain protected in advance.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If full-disk encryption is enabled on a physical server, then data security is improved, but human intervention is required to manually input passphrases at startup

Engineering Contradiction:

Improvedata securityVSAvoidmanual passphrase input requirement

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system implements self-service by automatically managing key encryption and decryption operations without requiring manual passphrase input. The encryption process autonomously handles key generation, encryption, and decryption using stored customer master keys and key encryption keys, eliminating the need for human intervention during startup and data access operations.

Inventive Principle:

Principle #25Self-service

3Reliability

If database-level encryption is implemented, then data security is improved, but the passphrase must be entered at database startup and key management complexity increases

Engineering Contradiction:

Improvedata securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces key encryption keys as intermediaries between customer master keys and data keys. This intermediary layer simplifies key management by allowing customer master keys to remain secure and unchanged while enabling flexible encryption and decryption operations through the intermediary key encryption keys, reducing the complexity of direct key management.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system creates encrypted copies of keys at multiple levels: data keys are encrypted with key encryption keys to create encrypted data keys, and key encryption keys are encrypted with customer master keys to create encrypted key encryption keys. These encrypted copies can be stored and transmitted independently, simplifying key management and distribution while maintaining security.

Inventive Principle:

Principle #26Copying

4Reliability

If encrypted data needs to be transported or backed up, then data security is maintained, but key management and restoration complexity increases

Engineering Contradiction:

Improvedata security during transportVSAvoidbackup and restoration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The backup system segments encryption keys into portable key packages that can be independently managed and transported. Each key package contains encrypted keys and necessary metadata, allowing secure transport of encryption capabilities separate from the encrypted data itself, simplifying backup and restoration operations while maintaining security.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11310035B2Securing data at rest utilizing cloud provider service agnostic encrypted data transportability

Publication Date: 2022.04.19 GOOGLE LLC

AI summary

Securing at rest data on a cloud hosted server includes, for each cloud hosted instance of a computer program, creating a key encrypted key (KEK) using a unique customer master key (CMK) corresponding to the instance, but only an encrypted form of the KEK is persisted in a database for the corresponding instance whereas the unencrypted KEK is retained in memory of the encryption process only. Thereafter, in response to a request to persist data by a corresponding instance of the computer program, a data key (DK) is randomly generated and encrypted with the KEK in memory for the corresponding instance. The data itself also is encrypted with the DK and an envelope with the encrypted DK and the encrypted data returned to the requestor, thus ensuring that the data and the encryption keys are never moved or persisted in an un-encrypted form.