Confidential Container Secret Storage With User-Specific Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face challenges in securely managing sensitive data in cloud environments, particularly when deploying containerized applications, as they often store data in unencrypted forms, exposing it to security risks and introducing new vulnerabilities.
Innovation Solution
Implementing user-specific encryption keys within a hyper protect virtual machine based container to encrypt sensitive data before storage, ensuring only authorized users can access it, and using a cryptographic key pair for secure storage and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional software stores sensitive information in unencrypted form, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent applies preliminary action by encrypting sensitive information before it is stored in the system. The encryption occurs in advance during the deployment process, so that the data is already protected when it enters storage. This resolves the contradiction by maintaining ease of operation while pre-establishing security protection.
Solution Approach 2:
The patent introduces an intermediary encryption mechanism that acts as a mediator between the sensitive information and the storage system. The encryption layer serves as an intermediate protective barrier, allowing the system to maintain operational simplicity while introducing cryptographic protection through the intermediary encryption process.
2Reliability
If cryptography is introduced to protect workloads and data, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent applies self-service by implementing automatic encryption that occurs without requiring manual intervention or complex configuration. The system automatically handles the encryption of sensitive information during deployment, reducing the complexity burden on users while maintaining strong security protection through automated cryptographic operations.
Solution Approach 2:
The patent applies universality by creating a general-purpose encryption mechanism that can protect multiple types of sensitive information (secrets, configuration data, credentials) across different containerized applications. This universal approach consolidates security functionality into a single system that handles various data types, reducing overall device complexity compared to implementing separate security mechanisms for each data type.
3Reliability
If user-specific encryption keys are implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent applies segmentation by dividing the encryption key management into user-specific segments. Each user has their own encryption key that is independently managed and stored. This segmentation approach improves security by ensuring that compromise of one user's key does not affect others, while the automated key management system handles the complexity of maintaining multiple keys without requiring manual intervention for each key.
Data Source
AI summary
A method, in one general approach, includes: receiving a secret deployment request from a user. The secret deployment request is encrypted using a private key correlated with the user. Moreover, an encrypted version of the private key correlated with the user is stored in a hyper protect virtual machine based container. The method also includes storing the encrypted secret deployment request in memory.