Cloud Data Encryption via Segmented Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers in cloud storage environments cannot ensure user data confidentiality, as they may inadvertently or intentionally access or copy encrypted data, violating user privacy.
Innovation Solution
Implementing a security protocol where user data is encrypted with a data key, and only the user possesses the decryption password, which is never stored by the service provider. A public/private key pair is used to further encrypt the data key, ensuring that only the user can decrypt and access their data, even when sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user data is stored in service provider cloud, then data accessibility and convenience are improved, but service provider may access or copy encrypted data violating user privacy
Solution Approach 1:
The encryption key is segmented into two parts: a data encryption key stored on the user's device and a key encryption key stored only by the user locally. The service provider can only store encrypted data, not the keys needed to decrypt it, thus segmenting the security responsibilities between user and provider.
Solution Approach 2:
A cryptographic intermediary mechanism is introduced where the user's local key encryption key acts as a mediator between the service provider's encrypted data and the user's decryption capability. The service provider never possesses the ability to decrypt data, as the decryption capability remains with the user through this intermediary key mechanism.
2Ease of operation
If service provider stores user passwords for authentication, then authentication convenience is improved, but security is worsened as passwords become vulnerable to breaches
Solution Approach 1:
The password security problem is extracted from the service provider's responsibility. Instead of the service provider storing or managing passwords, the system extracts authentication to rely on device-level security (biometrics, device passwords) and local key storage, removing the vulnerability of centralized password storage.
Solution Approach 2:
Authentication becomes a self-service process where the user's device handles password verification and key protection locally. The service provider only receives authentication results, not the actual credentials, making the system self-protecting against credential theft.
3Productivity
If data is encrypted with symmetric key, then encryption speed is improved, but key distribution security is worsened
Solution Approach 1:
The key management is segmented into symmetric encryption for data (fast) and asymmetric encryption for key protection (secure). The symmetric data encryption key is protected by the user's asymmetric key encryption key, combining the speed advantage of symmetric encryption with the security advantage of asymmetric key distribution.
Solution Approach 2:
A composite encryption approach is used, combining symmetric encryption (AES) for data confidentiality with asymmetric encryption (RSA) for key protection. This composite approach leverages the strengths of both encryption types: speed of symmetric and security of asymmetric.
Data Source
AI summary
Subscriber (user) data is encrypted and stored in a service provider cloud in a manner such that the service provider is unable to decrypt and, as a consequence, to view, access or copy the data. Only the user knows a user-specific secret (e.g., a password) that is the basis of the encryption. The techniques herein enable the user to share his or her data, privately or publicly, without exposing the user-specific secret with anyone or any entity (such as the service provider).