Cloud Server Data Encryption via User Session Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based servers, considered semi-trusted, are vulnerable to attacks that can expose users' personal data to unauthorized access, as existing security measures are not sufficient to prevent repeated attacks and data misuse.
Innovation Solution
Implementing a method where user-provided session keys are used for encrypting and decrypting data on the cloud server, with the key being discarded after each session to limit access, and periodically replaced to segment data, ensuring only current data is decrypted during an attack, while previous data remains protected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If personal data is stored on a cloud-based server, then data accessibility and processing capability are improved, but security against unauthorized access deteriorates
Solution Approach 1:
The encryption key is extracted from the cloud server environment and held exclusively by the user's device. The server stores only encrypted data without access to decryption keys, effectively removing the vulnerability point from the server while maintaining data accessibility through client-side decryption capability.
Solution Approach 2:
Session keys are automatically discarded after each data access session completes. The system recovers data by重新 generating new session keys for subsequent sessions, ensuring that even if one session key is compromised, previous and future data remain protected through key rotation.
2Object-affected harmful factors
If encryption is implemented on the cloud server, then data security is improved, but processing efficiency deteriorates
Solution Approach 1:
Data is encrypted in advance before being uploaded to the cloud server. This preliminary encryption action eliminates the need for real-time encryption/decryption operations during data processing on the server, thereby maintaining processing efficiency while ensuring data protection throughout storage and transmission.
3Ease of operation
If session keys are reused across multiple sessions, then operational convenience is improved, but security against repeated attacks deteriorates
Solution Approach 1:
Session keys are periodically regenerated and rotated after each usage session. This periodic key replacement ensures that encryption credentials remain fresh and limited in scope, preventing attackers from exploiting reused keys across multiple sessions while maintaining operational convenience through automated key management.
Data Source
AI summary
In one embodiment, a method for securing data on a semi-trusted server is implemented on a computing device and includes: receiving at least a current session key from a user device for use during a current session, where the current session key is suitable for encrypting data and for decrypting data encrypted with the current session key, decrypting communications received from the user device during the session with said session key, encrypting with the session key at least one of communications to be sent to said user device and personal data generated during the session, storing the encrypted personal data, and discarding the current session key upon completion of the session, thereby limiting possible access to the stored encrypted personal data other than during the session. Related apparatus and methods are also described.