Cloud Storage Access via Key Management Server Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network storage devices face challenges in secure sharing of data among multiple users, as administrators must manually grant and revoke access, leading to potential data leakage and compromised credentials.
Innovation Solution
A system that allows third-party devices of authorized users to access data by generating a digital certificate using a key management server, enabling secure commands to be issued to the cloud storage device, which validates and processes these commands based on permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual credential management is used for access control, then data security is maintained, but data sharing efficiency deteriorates
Solution Approach 1:
The patent introduces a Key Management Server (KMS) as an intermediary between users and the storage device. The KMS generates key pairs, manages digital certificates, and handles access token issuance. This intermediary automates the credential management process, eliminating manual administrator intervention while maintaining security through cryptographic mechanisms. The KMS acts as a trusted third party that enables seamless data sharing without compromising security.
Solution Approach 2:
The system enables self-service access management where users can independently generate key pairs, obtain digital certificates from the KMS, and manage their own access tokens without requiring administrator intervention. Users can autonomously share data by distributing their public keys or access tokens to authorized parties, and can revoke access by invalidating their tokens. This self-service capability dramatically improves data sharing efficiency while maintaining security through automated cryptographic validation.
2Reliability
If encrypted data storage is implemented, then data security is improved, but administrator access capability deteriorates
Solution Approach 1:
The KMS serves as an intermediary that manages encryption keys and decryption capabilities. When administrators need to access encrypted data, they do so through the KMS, which validates their credentials and provides temporary decryption keys or access tokens. This maintains strong encryption security while enabling administrator access through a controlled, automated process rather than requiring them to manually manage encryption keys.
Solution Approach 2:
The patent replaces manual mechanical key management with automated cryptographic systems. Encryption keys are generated and managed through cryptographic operations performed by the KMS and storage device firmware. Access control is achieved through digital signatures and cryptographic validation rather than physical key distribution. This substitution automates the previously manual process of key management, making it both more secure and easier to operate.
3Reliability
If digital certificate-based access control is implemented, then access security is improved, but system complexity increases
Solution Approach 1:
The KMS performs multiple functions within a single system component: it generates key pairs, issues digital certificates, validates access tokens, and manages credential storage. The storage device firmware also performs multiple functions including cryptographic validation, access control enforcement, and secure key storage. This consolidation of multiple security functions into integrated components reduces overall system complexity compared to implementing separate systems for each function.
Data Source
AI summary
In some aspects, the techniques described herein relate to a method including: transmitting, by a user device, a public key of a client device to a key management server (KMS); generating, by the KMS, a digital certificate using the public key of the client device; storing the digital certificate in a storage device of a cloud service; generating, by the client device, a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the client device; and issuing the signed command to the storage device to access data stored by the storage device.