Cloud Storage Encryption Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud storage security solutions do not allow customers to maintain sole control over their data and encryption keys, lack automated key management, and are not compatible with multiple cloud storage services, compromising data integrity and security.
Innovation Solution
A comprehensive cloud storage encryption system that uses AES in Galois/Counter Mode (GCM) for authenticated encryption, manages keys through a centralized policy engine, and supports multiple cloud vendors without modifying existing client code, ensuring data integrity and security by keeping encryption keys under customer control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud storage providers use their own key management systems to encrypt data, then data can be stored and accessed efficiently, but the cloud provider gains access to plaintext data and encryption keys, compromising customer data security
Solution Approach 1:
The system segments the encryption key management by separating data encryption keys (DEKs) from key management system (KMS) encryption keys. Each object is encrypted with its own DEK, and the DEK is wrapped with the customer's KMS key, dividing key management responsibilities between cloud storage and customer-controlled KMS
Solution Approach 2:
The system introduces an intermediary wrapping process where the customer's KMS key acts as a mediator between the DEK and the cloud storage system. The DEK is encrypted (wrapped) with the KMS key before being stored with the object, allowing the cloud provider to decrypt data without accessing the original DEK or KMS key
2Ease of operation
If manual key management is implemented at the client side, then encryption can be performed, but key management becomes cumbersome and security is compromised due to limited key usage
Solution Approach 1:
The system enables self-service key management where the customer's KMS automatically generates, manages, and rotates encryption keys without manual intervention. The KMS handles key lifecycle operations including generation, distribution to cloud storage, rotation, and revocation, eliminating the need for manual key management while maintaining security
Solution Approach 2:
The customer-controlled KMS serves multiple functions: generating DEKs for object encryption, wrapping DEKs with KMS keys, managing key rotation, and controlling key access policies. This single multi-functional KMS system replaces multiple manual key management operations
3Adaptability or versatility
If cloud-based key management is used, then key management functionality is provided, but the cloud provider maintains access to encryption keys, preventing customers from maintaining sole control over their data
Solution Approach 1:
The system inverts the traditional cloud-based KMS model by placing the KMS under customer control rather than cloud provider control. The customer deploys and operates their own KMS that manages encryption keys for cloud storage, reversing the typical architecture where the cloud provider manages keys for stored data
Data Source
AI summary
Techniques are disclosed for securing data in a cloud storage. Plaintext files are stored as secured, encrypted files in the cloud. The ciphering scheme employs per-block authenticated encryption and decryption. A unique file-key is used to encrypt each file. The file-key is wrapped by authenticated encryption in a wrapping-key that may be shared between files. A centralized security policy contains policy definitions which determine which files will share the wrapping-key. Wrapping-keys are stored in a KMIP compliant key manager which may be backed by a hardware security module (HSM). File metadata is further protected by a keyed-hash message authentication code (HMAC). A policy engine along with administrative tools enforce the security policy which also remains encrypted in the system.