Distributed Key Storage for Secure Cloud Data Deletion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service users face challenges in ensuring secure data storage and deletion, as they lack control over access and verification of data integrity, and orphan copies may remain in third-party storage systems, potentially compromising sensitive information.
Innovation Solution
A data storage architecture that encrypts files with file-specific keys, which are then encrypted with a master key, and stored remotely, ensuring that only authorized access can decrypt the data, and implementing a deleted file processing system to ensure data is no longer recoverable after a predefined time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If data is stored remotely in a cloud service system, then data storage capacity and accessibility are improved, but control over access and verification of data integrity deteriorate
Solution Approach 1:
The encryption key is divided into multiple segments and distributed across different storage locations. The first portion is stored locally with the encrypted data, while the second portion is stored remotely. This segmentation allows the system to maintain remote storage capabilities while preserving local control over key recovery, enabling verification of data integrity without centralized control.
2Quantity of substance
If data deletion is performed in a third-party storage system, then storage space is freed, but assurance of complete data removal deteriorates due to potential orphan copies
Solution Approach 1:
Before data is deleted from the remote storage system, the system performs preliminary actions by maintaining a local copy of the encryption key portion. This allows the system to verify data removal by attempting decryption with the local key portion. If decryption fails or the key portion is no longer valid, it confirms complete removal, providing reliability assurance before storage space is fully reclaimed.
3Reliability
If data is encrypted with file-specific keys for security, then data security is improved, but complexity of key management deteriorates
Solution Approach 1:
The system merges the key management approach by combining local and remote storage of key portions. Instead of managing entirely separate key systems, the invention integrates both local and remote key storage, where the local portion enables verification and the remote portion enables secure storage. This unified approach reduces overall key management complexity while maintaining strong security through the distributed key architecture.
Data Source
AI summary
A data file is encrypted with a file-specific encryption key and sent to a remote data storage system. The file-specific encryption key is encrypted with a master key. The encrypted file-specific encryption key and the master key are both stored remotely from the encrypted file and they are stored remotely from one another.