Distributed Cloud Recovery Data Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based data storage systems face security concerns when storing critical recovery data across multiple providers, as clients lose control over security mechanisms and risk increased attacks from malicious parties.
Innovation Solution
Implementing a secret sharing mechanism for encryption keys across multiple cloud-based storage systems, where coordination between systems is required to decrypt recovery data, ensuring that no single system can access it without others, and using a data recovery manager to coordinate distribution and acquisition of recovery information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If recovery data is stored across multiple cloud-based providers, then data availability and redundancy are improved, but security control and access security deteriorate
Solution Approach 1:
The encryption key is divided into multiple key shares that are distributed across different cloud-based storage systems. No single system holds the complete key, so even if one system is compromised, the full encryption key cannot be reconstructed. This segmentation approach maintains data availability across multiple providers while enhancing security by preventing any single point of failure from exposing the complete cryptographic secret.
Solution Approach 2:
A data recovery manager acts as an intermediary component that coordinates access to recovery data across multiple cloud-based storage systems. This mediator implements secret sharing mechanisms and manages the distribution of key shares, enabling secure data retrieval without requiring any single cloud provider to have full access to the encryption key, thus maintaining security control while enabling distributed storage.
2Object-affected harmful factors
If encryption keys are distributed across multiple systems, then security against single-point compromise is improved, but system complexity for key management increases
Solution Approach 1:
The data recovery manager implements automated secret sharing mechanisms that enable systems to self-manage key distribution and reconstruction. The system automatically divides encryption keys into shares, distributes them across storage systems, and handles the coordination for key reconstruction when needed, reducing manual intervention and simplifying the complexity of managing distributed cryptographic secrets.
3Object-affected harmful factors
If coordination between multiple cloud systems is required for decryption, then unauthorized access risk is reduced, but data recovery time increases
Solution Approach 1:
Encryption keys are pre-divided into shares and distributed to multiple cloud-based storage systems before data storage occurs. This preliminary distribution of key shares establishes the security framework in advance, so that during data recovery operations, the system only needs to coordinate access to existing key shares rather than performing complex key generation and distribution operations, thereby reducing the time penalty associated with coordinated decryption.
Data Source
AI summary
Described is a system for securing recovery information that is distributed amongst multiple cloud-based systems. Encrypted recovery data may be stored on at least one cloud-based system. To decrypt the recovery data, coordination between multiple cloud-based systems may be required to obtain the encryption key. Accordingly, a production system does not have to perform key management. Therefore, even if the production system is compromised by a malicious party, the encryption key remains secure as multiple cloud-based systems would also have to be comprised. In addition, the system may coordinate the creation and distribution of the recovery information, as well as the acquisition of such recovery information as part of a data recovery process. Thus, the system may secure recovery information by leveraging multiple cloud-based systems (or services).