Hardware Security Device for Encrypted Cloud Database Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional data security techniques in cloud computing environments are inadequate, as they often convert encrypted data to cleartext, allowing cloud service provider employees to access sensitive information, compromising security.
Innovation Solution
A hardware security device is introduced within the cloud database platform that performs security functions using subscriber-specific cryptographic information, limiting cleartext data access and encrypting data both in transit and at rest, even when processed within the cloud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is converted to cleartext for processing in the cloud, then data processing functionality is improved, but data security deteriorates as cloud service provider employees gain access to sensitive information
Solution Approach 1:
The system segments data into encrypted portions that can be processed independently in the cloud without full decryption. The encryption key is separated from the data, with the data being processed in encrypted form while only specific encrypted portions need to be decrypted for particular operations, maintaining security while enabling functionality.
Solution Approach 2:
An encryption intermediary layer is introduced between the data and the cloud processing system. This intermediary maintains encryption during processing operations, allowing the cloud to work with encrypted data through specialized protocols that preserve security while enabling the necessary processing functionality.
2Ease of operation
If encryption keys are stored with the data in the cloud, then data access and processing is improved, but security control deteriorates as the cloud service provider gains access to decryption capabilities
Solution Approach 1:
The encryption key management is extracted from the cloud storage system and separated into a distinct key management component. Keys are stored separately from the encrypted data, with controlled access mechanisms that prevent cloud service providers from obtaining decryption capabilities while still allowing authorized data access when needed.
Solution Approach 2:
Encryption key protection measures are implemented in advance before data is stored in the cloud. Keys are pre-protected with access controls and security policies that prevent unauthorized access, ensuring that even if data is compromised, the encryption keys remain secure and inaccessible to cloud service providers.
3Ease of manufacture
If traditional cloud security techniques are used, then implementation simplicity is improved, but security effectiveness deteriorates as employees can access cleartext data
Solution Approach 1:
The encryption system is designed to work with standard cloud storage and processing operations, providing security across multiple functions and operations. The same encryption mechanisms protect data at rest, in transit, and during processing, maintaining implementation simplicity while significantly improving security effectiveness across all cloud operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A cloud computing service to securely process queries on a database. A security device and method of operation are also disclosed. The security device may be provisioned with a private key of a subscriber to the cloud service and may have processing hardware that uses that key, sequestering the key and encryption processing in hardware that others, including operating personnel of the cloud service, cannot readily access. Processing within the security device may decrypt queries received from the subscriber and may encrypt responses for communication over a public network. The device may perform functions on clear text, thereby limiting the amount of clear text data processed on the cloud platform, while limiting bandwidth consumed in communicating with the subscriber. Such processing may include formatting data, including arguments in a query, in a security protocol used by the cloud platform.