Encrypted Archive File Cloud Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based storage systems face challenges in securely sharing data across different operating systems without altering or customizing the operating system environment, as they often rely on client applications for encryption, which introduces additional processing and makes malware detection difficult.
Innovation Solution
The method involves generating an encrypted archive file representative of a drive using a Trusted Execution Environment (TEE), which is then shared and decrypted by a second user's device, allowing secure data sharing without requiring compatibility with the OS environment, utilizing a cloud service provider to manage encryption keys and access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client applications are used for encryption in cloud-based storage systems, then data can be encrypted and stored in the cloud, but the operating system environment must be altered or customized, and additional processing is introduced
Solution Approach 1:
The patent introduces a cloud service provider as an intermediary that performs encryption operations on client devices. The CSP receives encrypted data along with encryption parameters, performs the encryption processing in the cloud, and returns the encrypted data to clients. This eliminates the need for clients to have specialized encryption client applications while maintaining security.
Solution Approach 2:
The patent replaces the mechanical approach of installing encryption software on client operating systems with a cloud-based processing model. Instead of modifying client OS environments with encryption agents, the encryption functionality is moved to the cloud service provider's infrastructure, which processes encryption requests from multiple clients without requiring OS modifications on client sides.
2Reliability
If client applications perform encryption, then data security is improved, but malware detection becomes difficult due to additional processing
Solution Approach 1:
The cloud service provider acts as a trusted intermediary that performs encryption operations in a controlled environment. By moving encryption processing from untrusted client devices to the CSP's infrastructure, the system maintains security while enabling centralized monitoring and verification of encryption operations, making it easier to detect and prevent malware interference.
Solution Approach 2:
The encryption system is designed to be self-verifying through cryptographic proofs and attestation mechanisms. The CSP can verify that encryption operations are performed correctly without requiring external monitoring, and clients can verify that their data was properly encrypted by the CSP, creating a self-checking system that resists malware attacks.
3Reliability
If data is encrypted with individual keys for each user, then security is improved, but key management complexity increases
Solution Approach 1:
The patent merges individual user key management with the cloud service provider's infrastructure. Instead of each client managing their own encryption keys independently, the CSP consolidates key management operations, storing and managing encryption keys securely in the cloud. This reduces client-side complexity while maintaining individual user security requirements through proper key isolation and access control.
Solution Approach 2:
The cloud service provider implements a universal key management system that serves multiple clients and use cases. The CSP's key management infrastructure can handle encryption, decryption, key rotation, and access control for numerous users through a single centralized system, eliminating the need for each client to implement their own key management solution while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and apparatus to securely share data are disclosed. An example includes generating, at a first device of a first user of cloud services, an archive file representative of a drive of the first device; encrypting, via a processor, the archive file to form an encrypted archive file; and conveying the encrypted archive file to a cloud service provider, the encrypted archive file to be decrypted by a second device of a second user of the cloud services, the decrypted archive file to be mounted to an operating system of the second device.