Local Email Gateway for Secure Cloud Message Offloading

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The security of enterprise email systems is compromised when moved to the cloud, leading to 'data leakage' due to loss of control over email messages and mixed data storage among multiple customers, making it difficult to prevent unauthorized access to sensitive information.

Innovation Solution

A local email server appliance acts as a transparent proxy, using different credentials to securely connect to cloud-based email services, encrypting and decrypting messages within the enterprise's control, and managing encryption keys to prevent data leakage and ensure secure communication protocols.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If email workloads are moved to the cloud, then cost is reduced and scalability is improved, but security control and data privacy are compromised

Engineering Contradiction:

Improveemail service scalabilityVSAvoiddata security control

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments email data into encrypted components that are stored in the cloud, while keeping decryption keys and security control locally on enterprise premises. This allows cloud-based scalability while maintaining local security control.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An on-premises email gateway acts as an intermediary between the enterprise and cloud email services. The gateway encrypts emails before cloud transmission and decrypts them upon return, serving as a security mediator that enables cloud usage while preserving control.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If cloud vendors mix customer email data within a single store, then storage efficiency is improved, but data isolation and security are worsened

Engineering Contradiction:

Improvestorage efficiencyVSAvoiddata leakage risk

Core Design Contradiction:

Quantity of substanceVSObject-affected harmful factors

Solution Approach 1:

Each enterprise's email data is encrypted with unique keys and treated as having different security properties. The encryption ensures that even though physical storage may be shared, each enterprise's data maintains isolated security characteristics.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

Encryption creates an inert security environment where cloud-stored email data cannot be accessed or mixed in plaintext form. The encrypted state protects data from unauthorized access even in shared storage environments.

Inventive Principle:

Principle #39Inert atmosphere (Inert environment)

3Device complexity

If in-house administrators delegate control to cloud vendors, then service management complexity is reduced, but control over confidential data is lost

Engineering Contradiction:

Improvesystem management complexityVSAvoiddata access control

Core Design Contradiction:

Device complexityVSEase of operation

Solution Approach 1:

The on-premises email gateway serves as an intermediary that maintains administrative control. It automatically handles encryption, decryption, and security policy enforcement, allowing administrators to retain control without manual intervention in each cloud interaction.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The email gateway provides automated security functions including encryption, decryption, and policy enforcement. This self-service capability reduces the need for administrators to manually manage cloud security while maintaining control.

Inventive Principle:

Principle #25Self-service

4Ease of operation

If encryption keys are stored in the cloud service, then access convenience is improved, but security against cloud breaches is worsened

Engineering Contradiction:

Improvedata access convenienceVSAvoidbreach vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system extracts encryption keys from the cloud environment and stores them locally on enterprise premises. This separation ensures that even if cloud storage is breached, the keys needed to access the actual data remain secure locally.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system creates a separate security dimension by storing keys in a different location (on-premises) than the data (cloud). This spatial separation in another dimension protects against single-point failures and cloud-based attacks.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS9917835B2Techniques for secure message offloading

Publication Date: 2018.03.13 MICRO FOCUS LLC

AI summary

Techniques for secure message offloading are presented. An intermediary is transparently situated between a user's local messaging client and an external and remote messaging client. The user authenticates to the local client for access and the intermediary authenticates the user for access to the remote client using different credentials unknown to the user. Messages sent from the local client are transparently encrypted by the intermediary before being passed to the remote client and messages received from the remote client are transparently decrypted before being delivered to the local client.