Gateway DNS Modification for Secure Cloud File Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage methods either compromise user confidentiality by allowing cloud providers access to encryption keys or require users to carry and manage keys across devices, posing security risks when sharing files.
Innovation Solution
A method that establishes a secure connection between a user's device and a gateway computer system, which encrypts files using user-specific keys and manages key storage, allowing encrypted files to be stored in the cloud without exposing the keys to the cloud provider, and enables secure file sharing by managing access rights without revealing private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the cloud provider stores and manages encryption keys, then ease of operation is improved, but confidentiality is worsened because the cloud provider can access user data
Solution Approach 1:
The patent introduces a key management service as an intermediary between users and cloud storage. This service stores encryption keys securely and manages key distribution without requiring users to manually handle keys. The intermediary handles key generation, storage, and distribution while maintaining cryptographic security, thus improving ease of operation without compromising confidentiality.
2Object-affected harmful factors
If users carry encryption keys across devices, then confidentiality is improved, but device complexity is worsened due to key management requirements
Solution Approach 1:
The patent extracts the key management function from user devices and relocates it to a dedicated key management service. Users no longer need to store or manage keys locally on their devices. The key management service handles all cryptographic operations remotely, eliminating key management complexity from user devices while maintaining strong confidentiality through secure remote key control.
3Ease of operation
If users share files by providing decryption keys, then ease of operation is improved, but security is worsened because private keys are exposed
Solution Approach 1:
The patent segments the key management process into distinct cryptographic operations. Instead of sharing private keys, the system uses public key infrastructure where users share public keys or cryptographic tokens that enable file access without exposing private keys. The key management service performs cryptographic operations to generate secure sharing credentials, separating key storage from key usage and maintaining security while enabling easy file sharing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for accessing a data memory (128) of a cloud computer system (102) via a gateway computer system (100), wherein the gateway computer system is connected to the cloud computer system via a network (106), wherein the gateway computer system stores at least one cryptographic key (120), wherein the cloud computer system has an associated URL and wherein the gateway computer system has an associated IP address, wherein the domain name system of the Internet is modified such that the domain that the URL of the cloud computer system contains is resolved into the IP address of the gateway computer system, having the following steps: – set-up of a protected connection (110) between a first terminal (112) of the user and the gateway computer system via the Internet by a program on the terminal, this involving the URL of the cloud computer system being input into the program and the modified domain name system being used for name resolution for the URL, so that the protected connection is set up to the gateway computer system rather than to the cloud computer system, – transmission of a file (101) from the terminal to the gateway computer system via the protected connection, – set-up of a session (154) between the gateway computer system and the cloud computer system via the network, – encryption of the file using the cryptographic key by the gateway computer system, – transmission of the encrypted file (132) from the gateway computer system to the cloud computer system via the session, – storage of the encrypted file in the data memory of the cloud computer system.