Cloud Storage Data Privacy via Signed Commands
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network storage devices, encrypted user data prevents cloud administrators and automated processes from performing maintenance operations, and users cannot authorize third-party access without revealing their private key, while encrypted data remains vulnerable to modification and corruption.
Innovation Solution
A method involving generating a digital certificate using a secure environment's public key, storing it in a cloud service storage device, and issuing signed commands to access data, ensuring secure operations and permissions management through a key management server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user data is encrypted prior to writing to persistent storage, then data privacy is improved, but cloud administrators cannot access the data to perform maintenance operations
Solution Approach 1:
A key management server is introduced as an intermediary between cloud administrators and encrypted data. The server holds decryption keys and enables authorized access to encrypted data for maintenance operations without compromising data privacy. Administrators interact with the key management server rather than directly accessing encrypted storage, resolving the contradiction between privacy and operational accessibility.
2Reliability
If users hold private keys to decrypt their data, then data privacy is improved, but users cannot authorize third-party access without revealing their private key
Solution Approach 1:
The key management server acts as a mediator that users can authorize third parties to access through controlled mechanisms. Users maintain their private keys for privacy, while the server provides a controlled interface for authorized third-party access, eliminating the need to reveal private keys while enabling versatile access authorization.
Solution Approach 2:
Access control is segmented into multiple layers: user authentication to the key management server, authorization of third parties, and controlled key delivery. This segmentation allows users to maintain privacy while enabling versatile access patterns without exposing private keys directly to third parties.
3Reliability
If data is encrypted to prevent unauthorized access, then data privacy is improved, but encrypted data remains vulnerable to modification and corruption
Solution Approach 1:
Cryptographic integrity mechanisms provide feedback about data authenticity and integrity. The system can detect modifications and corruptions through integrity checks, alerting users and enabling corrective actions. This feedback mechanism addresses the vulnerability of encrypted data to modification by continuously monitoring data integrity.
Data Source
AI summary
In some aspects, the techniques described herein relate to a method including: generating a digital certificate using a public key of a secure environment; storing the digital certificate in a storage device of a cloud service; generating, by the secure environment, a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the secure environment; and issuing the signed command to the storage device to access data stored by the storage device.