Encrypted Data Storage via Portable Media and Key Wrapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in securely transferring and storing large volumes of sensitive data, particularly when using cloud storage services, as existing methods either require insecure network transmissions or physical devices that lack control and security during shipment.
Innovation Solution
A data management component encrypts data using a key management service, allowing it to be stored on a portable storage device, which remains encrypted until accessed by the storage service, using a wrapped key that only the key management service can decrypt, ensuring secure storage and transmission without exposing the encryption key to unauthorized parties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is transmitted over a secure network connection, then data security is improved, but it becomes impractical for extremely large data sets
Solution Approach 1:
The patent divides the data transfer process into two distinct phases: (1) physical transfer of encrypted data on portable storage devices, and (2) cryptographic key transmission over secure networks. This segmentation allows large datasets to be moved physically while only small cryptographic keys are transmitted electronically, resolving the contradiction between security and feasibility for large data transfers.
Solution Approach 2:
The patent introduces portable storage devices as intermediaries that carry encrypted data physically between locations. These devices serve as a mediator that enables secure transfer of large datasets without requiring direct network transmission, thus maintaining security while making the transfer practical for extremely large data sets.
2Productivity
If a physical storage device is used to transfer large amounts of data, then data transfer capability is improved, but the device remains under third party control during shipment
Solution Approach 1:
The patent applies preliminary anti-action by encrypting the data on the portable storage device before it enters third-party control during shipment. The encryption is performed in advance, so that even if the device is intercepted or mishandled, the data remains protected. This preemptive security measure counteracts the risk of losing device control during transit.
3Reliability
If encryption is implemented for data security, then data protection is improved, but key management complexity increases
Solution Approach 1:
The patent extracts the key management complexity from the user's responsibilities and places it entirely on the service provider's infrastructure. Users simply encrypt data with keys they generate and store the encrypted data on portable devices; the service provider handles key wrapping, storage, and management in the cloud. This extraction of complexity resolves the contradiction by maintaining strong encryption while eliminating user burden for key management.
Solution Approach 2:
The system implements self-service by automatically handling key wrapping and management operations without requiring user intervention. When encrypted data is uploaded, the system automatically wraps the encryption keys with additional keys for secure storage. When data is downloaded, the system automatically unwraps and manages key access. This automation eliminates manual key management complexity while maintaining security.
4Ease of operation
If data is stored in cloud resource environment, then storage convenience is improved, but user control over security and access is reduced
Solution Approach 1:
The patent adds a new dimension to cloud storage by implementing client-side encryption before data upload. This creates a layered security model where encryption occurs at the user's location (first dimension) and the service provider operates in a separate security dimension (second dimension) with wrapped keys. This dimensional separation allows users to maintain control over their data's cryptographic protection while still enjoying cloud storage convenience.
Data Source
AI summary
Large volumes of data to be securely imported to, and exported from, a data storage service or other such location in a secure manner without a customer having to manage keys or encryption. A data management component can execute on a client device that can identify data to be stored and obtain the appropriate key for encrypting the data. Once the data is encrypted, the data can be transmitted to the data storage service. When the data is received to the data storage service, an ingestion station reads the encrypted data and causes the encrypted data to be stored to the data storage service. The data remains encrypted from the client device through being stored to the data storage service. When a request for the data is received, access to the key can be obtained and the data decrypted and returned in response to the request.