Cloud Data Sharing via Hierarchical Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud service technologies face challenges in securely sharing electronic assets among users without exposing private keys, as storing private keys on computing devices rather than in the cloud service limits the cloud's ability to decrypt and share data with other users.
Innovation Solution
Implementing a sharing manager and sharing client within the cloud service that utilize protected cloud storage objects (PCSOs) with master and private keys, along with Uniform Resource Locators (URLs) to enable secure private and public sharing by encrypting and decrypting data using these keys, while keeping private keys secure on user devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored on user computing devices rather than in the cloud service, then user data security is improved, but the cloud service's ability to decrypt and share data with other users deteriorates
Solution Approach 1:
The patent segments the key management system into multiple hierarchical levels: user private keys stored on devices, cloud master keys stored in the cloud, and sharing keys generated for specific sharing sessions. This segmentation allows the cloud service to maintain security while enabling controlled data sharing through the hierarchical key structure where cloud master keys can decrypt data encrypted by user private keys when sharing is authorized.
Solution Approach 2:
The patent introduces cloud master keys as intermediary elements between user private keys and the actual data. The cloud service stores encrypted user data along with the corresponding cloud master keys, which act as mediators to enable the cloud to decrypt and share data with other users while the user's original private keys remain secure on their devices. This intermediary mechanism resolves the contradiction by allowing cloud-based sharing without compromising user key security.
2Adaptability or versatility
If cloud services store user data and enable sharing functionality, then data accessibility and sharing versatility are improved, but security risks and exposure to adverse parties increase
Solution Approach 1:
The patent applies segmentation by separating different types of keys into different storage locations and security contexts. User private keys remain on user devices, cloud master keys are stored in the cloud but encrypted, and sharing keys are generated temporarily for specific sharing sessions. This multi-level segmentation ensures that even though the cloud stores data and sharing information, the critical private keys are distributed and protected, reducing security risks while maintaining sharing functionality.
Solution Approach 2:
The patent implements preliminary action by pre-establishing a hierarchical key structure and encryption schemes before actual data sharing occurs. The cloud service pre-stores master keys and encryption parameters, and the system pre-configures sharing mechanisms that can be activated when needed. This preliminary setup enables secure sharing without requiring real-time key generation or storage, thereby reducing security exposure during the sharing process while maintaining versatility.
Data Source
AI summary
The embodiments set forth techniques for implementing a cloud service that enables cloud data to be shared between different users in a secure manner. One embodiment involves a sharing manager and a sharing client, where the sharing manager is configured to manage various data components stored within a storage system managed by the cloud service. These data components can include user accounts, share objects (for sharing data between users—and, in some cases, public users not known to the sharing manager)—as well as various “wrapping objects” that enable data to be logically separated in an organized manner within the storage system. According to this approach, the sharing client is configured to interface with the sharing manager in order to carry out various encryption/decryption techniques that enable the cloud data to be securely shared between the users.