Hierarchical Key Decryption for Secure Tenant Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems lack robust security measures to ensure secure access and management of sensitive information, particularly in software applications, and there is a need for efficient key management and encryption protocols to protect data repositories.
Innovation Solution
A system utilizing multiple encryption keys, including tenant service keys and tenant master keys, encrypted with customer keys, stored in a secure database, and managed by a key release system and key management system, with audit logs and blockchain verification to ensure secure storage and retrieval of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using multiple encryption keys stored in a secure database, then data security is improved, but key management complexity increases
Solution Approach 1:
The encryption key management is segmented into multiple hierarchical levels (customer keys, tenant service keys, tenant master keys). Each key operates at a different security level and has specific functions, allowing the system to maintain high security while managing complexity through structured division of key responsibilities
Solution Approach 2:
A key management system acts as an intermediary between the secure database and data storage systems. This intermediary handles key generation, distribution, rotation, and revocation automatically, reducing the complexity burden on users while maintaining multi-key security architecture
2Reliability
If audit logs and blockchain verification are implemented, then access control security is improved, but system complexity increases
Solution Approach 1:
Audit logging and blockchain verification are implemented as preliminary automated actions that occur automatically with each key access and data operation. This preliminary automation ensures security requirements are met without requiring complex manual verification processes
Solution Approach 2:
The system creates cryptographic copies and hashes of key access information that are stored on the blockchain. These cryptographic representations verify access control security without requiring the blockchain to store or process the actual sensitive key data, reducing system complexity
3Reliability
If multiple encryption keys are used for data protection, then data security is improved, but key retrieval and decryption time increases
Solution Approach 1:
The system performs preliminary key retrieval and caching operations before actual data decryption is needed. Frequently used keys are pre-loaded into memory, and key hierarchy relationships are pre-computed, allowing rapid decryption when data access is required
Solution Approach 2:
The key retrieval process is segmented into parallel operations where different keys are fetched simultaneously from different storage locations. The hierarchical key structure allows independent retrieval of customer keys, tenant service keys, and tenant master keys without sequential dependencies
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A system for secure retrieval of stored data includes an encrypted key database and a processor. The encrypted key database is configured to store an encrypted tenant service key and an encrypted tenant master key. The processor is configured to request decryption of the encrypted tenant master key into an unencrypted tenant master key. The decryption of the encrypted master key is approved by a key release system. The processor is further configured to decrypt the encrypted tenant service key using the unencrypted tenant master key into an unencrypted tenant service key and authorize a response to a request using the unencrypted tenant service key.