Cloud Secret Storage Using Remote Key Vault Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based service providers face challenges in securely storing and managing customers' sensitive information, as existing solutions do not adequately prevent unauthorized access by other customers or malicious actors, including the service provider.
Innovation Solution
Implementing a system that encrypts sensitive information using a private key stored in a remote key vault, with additional encryption during transit, and utilizing a secure data wallet for decryption and access control, ensuring only authorized parties can access the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If secret information is stored on cloud service, then customers can easily access the information, but the information may be readable by unauthorized parties including other customers and malicious actors
Solution Approach 1:
The system segments the secret information into encrypted form stored in cloud storage, with the decryption key held separately by the customer. This segmentation allows the cloud service to provide storage and retrieval functionality while the customer maintains exclusive control over the decrypted information through possession of the key.
Solution Approach 2:
The patent introduces encryption as an intermediary mechanism between the stored information and potential unauthorized access. The encrypted data stored in cloud storage acts as an intermediary state that is inaccessible without the proper decryption key, thereby protecting the secret information while maintaining cloud-based accessibility.
2Object-affected harmful factors
If secret information is encrypted and stored in cloud storage, then unauthorized access is prevented, but the complexity of the storage system increases
Solution Approach 1:
The system implements self-service by requiring the customer to provide and manage their own encryption key. The cloud service provider does not need to implement or manage the encryption mechanism themselves - they simply store the encrypted data and the customer manages the key, thereby distributing the complexity management burden to the customer while maintaining system security.
Data Source
AI summary
Embodiments of the disclosure include systems and methods for secure storage and/or retrieval of customer secrets by, e.g., a cloud services provider. According to methods, secret data that is to be securely stored may be transmitted, along with an initialization vector, to an encryption service for encryption using a private key stored on in a remote key vault. The encrypted data can be returned and stored, in its encrypted form, in a secure storage along with the initialization vector data. To retrieve the securely stored data, embodiments disclose retrieving the encrypted form of the data and transmitting it, along with its related initialization vector data, to the encryption service for decryption using the private key stored in the remote key vault. The decrypted data can then be made available to a requesting product service.