Elliptic Curve Key Management for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management solutions for cloud-stored data face challenges such as increased costs due to insider threats, elevated key management and storage costs for cloud servers, and increased computational burdens on Hardware Security Modules (HSMs) due to layer-by-layer key wrapping structures.
Innovation Solution
A key management method utilizing elliptic curve cryptography (ECC) where a client generates encryption ciphertexts and symmetric key sequences using public keys from both the HSM and the client, allowing cloud servers to store encrypted data without processing data keys, thereby reducing the computational load on HSMs and storage requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud servers process and manage data keys directly, then data security can be maintained, but computational burden and storage costs increase significantly
Solution Approach 1:
The patent extracts the data key management functions from the cloud server system. Specifically, it separates the generation and management of data keys (handled by client devices) from the storage and processing of encrypted data (handled by cloud servers). This extraction eliminates the computational burden on cloud servers while maintaining security through cryptographic protocols.
Solution Approach 2:
The patent introduces cryptographic intermediaries (encryption protocols, digital signatures, and key exchange mechanisms) that enable secure data management without requiring cloud servers to directly process data keys. These intermediaries facilitate secure communication and verification between clients and cloud servers while keeping key management operations local to client devices.
2Adaptability or versatility
If cloud servers store encrypted data with full key management capabilities, then data access control is improved, but storage costs and system complexity increase
Solution Approach 1:
The patent segments the key management system into distinct functional components: client devices generate and manage data keys, cloud servers store encrypted data, and cryptographic protocols mediate access. This segmentation distributes complexity across different system elements rather than concentrating it in the cloud server, simplifying the overall architecture while maintaining flexible access control.
Solution Approach 2:
Client devices perform self-service key management operations including key generation, encryption, and decryption locally. This self-service approach eliminates the need for cloud servers to implement complex key management infrastructure, reducing system complexity while preserving fine-grained access control capabilities through client-side cryptographic operations.
3Reliability
If layer-by-layer key wrapping structures are used, then security layers are enhanced, but HSM computational load increases
Solution Approach 1:
The patent extracts key wrapping operations from the HSM to client devices. Client devices perform data key generation and encryption locally, eliminating the need for HSM to process multiple layers of key wrapping. This extraction maintains security through cryptographic protocols while significantly reducing HSM computational load to only essential key protection operations.
Data Source
AI summary
Embodiments of this disclosure disclose a key management method and a related device, the method including: selecting a random number and a key according to an operation instruction inputted by a user; generating a first encryption ciphertext of the key, according to the random number, the key, a first public key, and a second public key, the first public key being determined according to a point on an elliptic curve and a private key of a hardware security module (HSM), and the second public key being determined according to the point on the elliptic curve and a private key of the client; generating a symmetric key sequence according to the key and a preselected hash function; encrypting data according to the symmetric key sequence to obtain a data ciphertext; and transmitting the first encryption ciphertext and the data ciphertext to a cloud server.