Cloud Data Protection via Local Key Generation and Mediator Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption techniques for protecting data in cloud applications are cumbersome for average users, making data stored in the cloud vulnerable to unauthorized access.
Innovation Solution
A system that generates a plaintext encryption key on a computing device, encrypts it using the customer's credential, and stores the encrypted key in a key server, while encrypting and decrypting data using this key to secure data storage and retrieval in cloud applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption techniques are used to protect data in the cloud, then data security is improved, but the complexity and difficulty of operation increases for average users
Solution Approach 1:
The patent introduces a key server as an intermediary between the user and the encryption process. The key server automatically manages encryption keys, performs encryption/decryption operations, and handles key distribution. This mediator handles the cryptographic complexity behind the scenes while presenting a simple interface to users, thus maintaining data security through proper encryption while eliminating the operational burden from average users.
2Reliability
If encryption keys are stored securely to protect data, then data security is improved, but the complexity of key management increases
Solution Approach 1:
The patent extracts the key management functionality from the user's local device and places it in a dedicated key server. The key server is specifically designed to handle key generation, storage, distribution, and rotation. By separating this complex function into a specialized external component, the system maintains strong security controls while reducing the complexity burden on the overall system and individual users.
Solution Approach 2:
The key server implements automated self-service mechanisms for key management. It automatically generates encryption keys, manages their lifecycle (creation, distribution, rotation, revocation), and handles recovery procedures without requiring manual intervention. This automation eliminates the complexity of manual key management while maintaining security best practices, allowing the system to serve itself rather than requiring complex human management processes.
Data Source
AI summary
A system for protecting data stored in the cloud includes a computing device that generates a plaintext encryption key and encrypts the plaintext encryption key using a credential of a customer that uses a cloud application. The computing device encrypts plaintext data using the encryption key and forwards the encrypted data to a cloud computer system that hosts the cloud application. The plaintext data can be received from a cloud application client that runs in the computing device or from another computing device that hosts the cloud application client. The encrypted encryption key can be stored in and retrieved from a key server.