Cloud Snapshot Transfer Using Master Encryption Key

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing techniques for copying structured data from one cloud account to another often result in loss of structure and are insecure, as they require unencrypted data transfer, exposing vulnerabilities due to differing local encryption keys.

Innovation Solution

The system uses snapshots to preserve structure during data transfer, encrypting snapshots with a master encryption key that is temporarily shared with accounts, ensuring secure and structured data transfer across cloud accounts without exposing local encryption keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing techniques are used to copy structured data from one cloud account to another, then data transfer can be performed, but the structure is lost and security is compromised due to unencrypted transfer

Engineering Contradiction:

Improvedata structure preservationVSAvoidsecurity vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of the snapshot data using the master encryption key before the data leaves the source account. This preliminary action ensures that the data is encrypted during transfer, preventing security vulnerabilities while preserving the snapshot structure that contains the structured data organization.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The master encryption key acts as an intermediary mechanism that enables secure data transfer between accounts with different local encryption keys. By introducing this intermediate encryption layer, the system allows structured data to be copied securely without requiring the destination account to have access to the source account's local encryption key, thus maintaining both security and structure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If local encryption keys are used for data protection in cloud accounts, then data security is maintained within accounts, but secure cross-account data transfer becomes impossible without exposing keys

Engineering Contradiction:

Improvedata securityVSAvoidcross-account data transfer

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The master encryption key serves as a mediator that facilitates cross-account data transfer without requiring exposure of local encryption keys. The snapshot is encrypted with the master key at the source account, transferred to the destination account, and then decrypted using the master key which the destination account is temporarily authorized to use. This intermediary mechanism maintains security while enabling ease of operation for cross-account transfers.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system changes the encryption parameter from account-specific local keys to a universal master encryption key during the transfer process. By temporarily authorizing the destination account to use the master key, the system dynamically changes the authorization parameters, allowing secure transfer without permanently exposing any encryption keys across account boundaries.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If snapshots are encrypted with a master encryption key for secure transfer, then security is improved, but key management complexity increases

Engineering Contradiction:

Improvetransfer securityVSAvoidkey management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts the encryption key management function into a separate key management service that handles master key generation, distribution, and revocation independently from the data storage and transfer operations. This separation reduces complexity by centralizing key management responsibilities and preventing key management logic from being scattered across multiple accounts and services.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The key management system automatically handles authorization of accounts to use the master key, generation of encryption/decryption operations, and revocation of access rights after transfer completion. This self-service automation reduces manual key management complexity while maintaining security through programmatic control of the encryption process.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12244713B2Snapshot transfer for cloud-based storage across accounts

Publication Date: 2025.03.04 CAPITAL ONE SERVICES LLC

AI summary

In some implementations, a system may receive a first credential associated with a first account and a second credential associated with a second account and may instruct a cloud service, using the first credential, to generate a first snapshot of structured source data associated with the first account. The system may authorize the first account and the second account to use a master encryption key and instruct the cloud service to encrypt the first snapshot using the master encryption key. The system may instruct the cloud service, using the second credential, to copy the first snapshot to a second snapshot associated with the second account and to decrypt the second snapshot into structured target data using the master encryption key. The system may deauthorize the first account and the second account from using the master encryption key and output an indicator of completion to a user device.