Encrypted Key Management for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional key management systems in computing environments are vulnerable as they often have access to plaintext keys, risking data compromise even if the system is secured.
Innovation Solution
Implementing a key management system where all keys remain encrypted on the server and are never decrypted, with decryption occurring solely on the client side using a master key stored securely, ensuring that neither keys nor encrypted objects are exposed in plaintext.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If keys are stored in plaintext in key management systems for easy access and management, then key management becomes simpler and more efficient, but the system becomes vulnerable to data compromise if the key management system is breached
Solution Approach 1:
The patent extracts the plaintext key from the key management system entirely. Keys are generated and stored only in encrypted form on the server, with the encryption key (master key) retained exclusively by the client. This extraction eliminates the vulnerability of storing plaintext keys while preserving key management functionality through encrypted operations.
Solution Approach 2:
The patent introduces encrypted keys as an intermediary between the client and server. Instead of directly storing or transmitting plaintext keys, the system uses encrypted key representations that require the master key for decryption. This intermediary layer protects against unauthorized access while enabling legitimate key management operations.
2Reliability
If multiple keys are used to encrypt different data or double encrypt data for enhanced security, then data protection improves, but key management complexity increases significantly
Solution Approach 1:
The patent segments the key management functionality into distinct components: key generation on the client side, encryption of keys on the server side, and selective decryption using the master key. This segmentation allows multiple keys to be managed independently and securely without creating a monolithic complex system, as each key can be handled through the same standardized encrypted workflow.
3Reliability
If keys are kept encrypted on the server and never decrypted to prevent data exposure, then data security is maintained even if the cloud service is compromised, but the system cannot provide backup or cloud access functionality
Solution Approach 1:
The patent implements self-service encryption where the client autonomously encrypts keys before uploading to the server and autonomously decrypts them during retrieval. This self-service approach eliminates the need for the server to have decryption capabilities, maintaining security while enabling full cloud functionality including backup and cross-device access through the client's master key.
Data Source
AI summary
Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.