Trusted Cloud Computing Framework with Searchable Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud services lack robust security measures to ensure data privacy and integrity, particularly when data is transmitted and stored remotely, leading to concerns about interference and exposure.
Innovation Solution
A trusted cloud services ecosystem is established, separating key generation, cryptographic technology, and cloud services providers to implement searchable encryption techniques, allowing publishers to encrypt data confidentially and grant selective access based on subscriber identity, thereby distributing trust across multiple entities to avoid single-point compromises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in cloud services, then accessibility and convenience are improved, but security and privacy protection deteriorate
Solution Approach 1:
The system segments the cryptographic key into multiple parts and distributes them to different cloud service providers. No single provider has access to the complete key, thus preventing any one entity from compromising data security while still enabling cloud storage and access functionality.
Solution Approach 2:
A trusted third party (such as a key management service or escrow agent) acts as an intermediary to manage and distribute key segments. This intermediary coordinates key distribution and recovery without having access to the full key, enabling secure cloud storage while maintaining user control over data access.
2Device complexity
If a single entity controls cryptographic keys, then key management is simplified, but security deteriorates due to single-point compromise
Solution Approach 1:
The cryptographic key is divided into multiple segments and distributed to different entities. This segmentation eliminates the single-point compromise vulnerability while the system manages the complexity of key distribution through automated protocols and trusted intermediaries.
Solution Approach 2:
The system transitions from a single-dimension key management model (one key held by one entity) to a multi-dimensional model where key segments are distributed across multiple entities. This dimensional change in key management architecture simultaneously improves security and maintains manageability through structured distribution protocols.
3Reliability
If encryption is implemented for data storage, then security is improved, but data searchability and accessibility deteriorate
Solution Approach 1:
Searchable encryption techniques are applied to encrypted data before storage, creating searchable encrypted indexes. This preliminary action enables the encrypted data to maintain searchability without requiring decryption, thus preserving both security and accessibility.
Solution Approach 2:
The system replaces traditional decryption-based search mechanisms with cryptographic search techniques. Instead of decrypting data to search it, the system uses mathematical properties of encryption schemes to enable direct searching of encrypted data, substituting mechanical decryption operations with cryptographic search operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A digital escrow pattern is provided for network data services including searchable encryption techniques for data stored in a cloud, distributing trust across multiple entities to avoid a single point of data compromise. In one embodiment, a key generator, a cryptographic technology provider and a cloud services provider are each provided as separate entities, enabling a publisher of data to publish data confidentially (encrypted) to a cloud services provider, and then expose the encrypted data selectively to subscribers requesting that data based on subscriber identity information encoded in key information generated in response to the subscriber requests, e.g., a role of the subscriber.