Multi-Tenant Cloud Data Encryption via Permutation Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud systems, existing encryption methods provide all-or-nothing access to data, making it difficult to allow access to only specific portions of data while maintaining privacy and security for other portions, especially when multiple tenants' data is involved.
Innovation Solution
A method that assigns a long bit stream to a client, from which derived keys are generated using permutations to decrypt specific data elements, allowing controlled access to portions of data while keeping other portions secure, using a system that includes a key vault for generating and storing long bit streams and permutations securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate encryption keys are used for each tenant, then security and privacy among tenants is improved, but device complexity and key management overhead increases
Solution Approach 1:
The patent combines multiple tenant-specific encryption keys into a single parent encryption key that secures encrypted data across all tenants. The parent key is used to encrypt data regardless of which tenant owns the data, eliminating the need for separate encryption keys per tenant while maintaining security boundaries through logical isolation rather than cryptographic separation.
Solution Approach 2:
The parent encryption key serves multiple functions: it encrypts data for all tenants, manages access control across the multi-tenant system, and enables selective access to specific data portions. This universal key replaces the traditional model where each tenant required dedicated encryption keys, simplifying key management while maintaining security.
2Reliability
If all-or-nothing access is provided to encrypted data, then security is improved, but adaptability and controlled access to specific data portions deteriorates
Solution Approach 1:
The patent segments encrypted data into distinct portions or partitions, each associated with specific tenants or data categories. While a single parent encryption key secures the entire encrypted data structure, the system can selectively decrypt and provide access to specific segments based on access permissions, enabling controlled access to portions of data without exposing the entire dataset.
Solution Approach 2:
The system implements local quality by applying different access control policies to different portions of the encrypted data. Each data segment can have its own access permissions and authorization rules, allowing the system to provide tailored access control for specific data portions while maintaining uniform cryptographic protection through the parent key.
3Adaptability or versatility
If multiple encryption keys are maintained for different data portions, then controlled access is improved, but loss of time and computational overhead increases
Solution Approach 1:
The patent merges the key management function into a single parent encryption key, eliminating the need to generate, store, rotate, and manage multiple separate encryption keys. This consolidation dramatically reduces key management time and computational overhead while maintaining the ability to control access to specific data portions through access control lists and permission mechanisms rather than cryptographic key separation.
Data Source
AI summary
Methods and apparatus, including computer program products, are provided for securing data in a multi-tenant cloud-based system. In some implementations, there is provided a method. The method may include requesting access to at least one encrypted data element; obtaining, in response to the requesting, a long bit stream assigned to a client associated with the requested access; generating a key to decrypt the at least one data element, the key generated by selecting, based on a permutation, portions of the long bit stream; and decrypting, based on the generated key, the at least one data element. Related systems, methods, and articles of manufacture are also disclosed.