Hybrid Cloud Security with On-Premise AES Key Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based security services (SECaaS) face challenges in securing confidential data due to the storage of sensitive information in public clouds, leading to security risks and customer reluctance to upload data, and require customers to manage servers when configured as platform as a service (PaaS).
Innovation Solution
A hybrid cloud-based security service apparatus and method that combines a public cloud with an on-premise system, using symmetric key encryption (AES) and logical operations (XOR) to encrypt and decrypt data, ensuring security and processing speed while maintaining data confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If confidential data is stored in public cloud for SECaaS, then service accessibility and convenience are improved, but data security and confidentiality are compromised
Solution Approach 1:
The system divides data into two types: confidential data stored locally on-premises and non-confidential data stored in public cloud. This segmentation allows different storage locations for different data types, achieving both security for sensitive information and cloud accessibility for general services.
Solution Approach 2:
Confidential data and encryption keys are extracted from the public cloud environment and stored locally on-premises. This extraction removes the security risk from the cloud environment while maintaining the ability to access encrypted data through cloud-based processing.
2Ease of operation
If all data is stored and processed in cloud for SECaaS, then service convenience is improved, but customer control and security management become difficult
Solution Approach 1:
Customers manage their own encryption keys and confidential data locally on-premises without requiring cloud provider assistance. This self-service approach gives customers direct control over their security assets while the cloud provider handles the encryption/decryption processing infrastructure.
3Speed
If encryption keys are stored in cloud database for easy access, then decryption speed is improved, but key security and confidentiality are compromised
Solution Approach 1:
The system separates the storage dimension (on-premises local storage for keys) from the processing dimension (cloud-based decryption service). Encryption keys remain stored locally for security, while the cloud provides computational power for decryption operations, achieving both security and speed.
Data Source
AI summary
A hybrid cloud-based security service apparatus for securing confidential data includes a cloud service module assigning an analysis identifier to data input by a user of a network connected to a cloud and receiving a request for delivery of encrypted data from the user, a key generation service unit located in an on-premise connected to the cloud and generating an encryption key based on the analysis ID, an encryption processing unit encrypting the data using the encryption key and a predetermined encryption algorithm, a logical operation unit performing a logical operation on the encryption key used to encrypt the data to invert predetermined bits of the encryption key, and a decryption service module receiving the encrypted data and the encryption key from the on-premise, restoring the encryption key by performing a logical operation, and decrypting the encrypted data using the restored encryption key and a decryption algorithm.