Enterprise Data Security via Interception and Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in securing and controlling data when using external storage providers, as they risk exposing sensitive data to untrusted third parties and lack granular access control, leading to potential unauthorized access and data exposure.
Innovation Solution
Implementing a method where a security agent intercepts requests to access files, encrypts them with a unique key, and manages access permissions through a centralized service, ensuring only authorized users can decrypt and access the files, even when transmitted to external storage providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is transmitted to external storage providers, then storage capacity and accessibility are improved, but data security and control are worsened
Solution Approach 1:
The system performs preliminary encryption of data before transmission to external storage providers. Security agents on client computers encrypt files using encryption keys managed by a centralized service before the files are uploaded to external storage, ensuring data is protected in advance rather than relying on post-transmission security measures.
Solution Approach 2:
A centralized service acts as an intermediary between clients and external storage providers for key management. The centralized service distributes encryption keys to authorized users and revokes access when needed, mediating the security control without requiring direct trust between clients and external storage providers.
2Adaptability or versatility
If external storage providers are used, then storage flexibility is improved, but access control granularity is worsened
Solution Approach 1:
The system segments access control by organizing users into groups and assigning different encryption keys to different groups. This allows fine-grained control where specific groups can access specific files, maintaining the flexibility of external storage while implementing detailed access control policies similar to enterprise networks.
Solution Approach 2:
The system implements dynamic access control where encryption keys can be distributed or revoked by the centralized service at any time. This allows access permissions to be changed dynamically without requiring changes to the external storage provider's infrastructure, enabling flexible authorization policies to be applied and modified as needed.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The methods and systems described herein provide for secure implementation of external storage providers in an enterprise setting. Specifically, the present invention provides for allowing the secure use of processes that may transmit files to external storage providers or access files from an external storage provider. In some arrangements, process, such as an untrusted process, may request access to a file. A security agent may intercept the request and encrypt the file. The file can then be transmitted to the external storage provider. A user may subsequently request access to the file. A security agent may intercept a message in connection with this request, determine whether the user is authorized to access the file, and decrypt the file.