Hierarchical Key Management for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing and storage environments, existing cryptographic key management systems store encrypted data and decryption keys together, making it vulnerable for unauthorized access if an unauthorized user gains access to the storage service.
Innovation Solution
Implementing a system where encrypted data and keys are stored separately, with a method that retrieves and decrypts keys using a hierarchical approach involving multiple keys and a hardware security module, ensuring that unauthorized access to either the data or keys is insufficient for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encrypted data and decryption keys are stored together in the same storage service, then access to the storage service provides access to both encrypted data and keys, but this configuration creates vulnerability to unauthorized access
Solution Approach 1:
The patent segments the key management system into multiple independent components: a key management service that stores encrypted keys, identity and access management services that control key retrieval, and data storage services that hold encrypted data. This segmentation ensures that no single service has access to both encrypted data and decryption keys simultaneously, resolving the security vulnerability while maintaining operational efficiency through defined service interactions.
2Reliability
If multiple keys are used in a hierarchical encryption approach, then unauthorized access to either data or keys is insufficient for decryption, but this increases system complexity
Solution Approach 1:
The patent introduces an intermediary key management service that acts as a mediator between data storage and decryption operations. This service holds encrypted keys, manages key retrieval through identity and access management verification, and coordinates the hierarchical decryption process. The intermediary simplifies the complex multi-key decryption workflow by centralizing key management operations and providing a controlled interface for key access.
3Productivity
If decrypted keys are cached for quick access, then decryption speed is improved, but the risk of unauthorized decryption increases if cache is compromised
Solution Approach 1:
The patent applies local quality by implementing different security characteristics for different storage locations. Decrypted keys cached in application servers have temporary, limited-access security properties suitable for active processing, while encrypted keys in the key management service have persistent, highly protected security properties. This differentiated approach allows fast local decryption operations while maintaining strong centralized security controls.
Data Source
AI summary
In various implementations, a first device retrieves, from a memory, encrypted data encrypted using a first key. The first device transmits, to a second device, a request for an encrypted first key, where the encrypted first key is generated by encrypting the first key using a second key. The first device receives the encrypted first key. The first device transmits, to an identity and access management device (IAM), a request for an encrypted second key, where the encrypted second key is generated by encrypting the second key using a third key. The first device receives the encrypted second key. The first device decrypts the encrypted second key using the third key, decrypts the encrypted first key using the decrypted second key, and decrypts the encrypted data using the decrypted first key. The first device deletes, from its cache, the decrypted first key after a period of time.