Key Hierarchy for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face challenges in ensuring the secure storage of sensitive customer data, as unauthorized access to physical servers can compromise data integrity, necessitating robust encryption and key management solutions to maintain customer trust.
Innovation Solution
A system that encrypts data files with unique keys, further encrypts these keys using a master key stored in a Hardware Security Module (HSM), ensuring that only authorized access can decrypt the data, even if the server is compromised, by creating a key hierarchy and utilizing an HSM for secure key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored remotely in the cloud, then data accessibility and service functionality are improved, but data security and control over access are worsened
Solution Approach 1:
The encryption key is segmented into multiple parts and distributed across different locations (customer premises and cloud storage). The data encryption key is split such that one portion is stored with the customer while another portion is stored with the cloud service provider, requiring both parts to reconstruct the full key for decryption. This segmentation ensures that neither party alone can access the encrypted data, resolving the contradiction between accessibility and security.
Solution Approach 2:
The patent implements nested encryption layers where a master key encrypts the data encryption key, which in turn encrypts the actual data. This multi-layer nested structure (master key → data encryption key → data) creates a hierarchy where each layer protects the next, allowing cloud storage while maintaining security through layered access control.
2Ease of operation
If encryption keys are stored with the data, then data decryption is simplified, but unauthorized access risk increases
Solution Approach 1:
The patent extracts the encryption key management function from the data storage location. Instead of storing the full decryption key with the encrypted data in the cloud, the key is split and one critical portion is extracted and kept by the customer on-premises. This extraction ensures that even if cloud storage is compromised, the extracted key portion remains secure with the customer, reducing unauthorized access risk while maintaining decryption capability.
3Adaptability or versatility
If cloud service providers have full access to customer data, then service functionality is improved, but customer trust and control are reduced
Solution Approach 1:
The patent segments key management authority between customer and provider. The customer retains control over the master key and one portion of the data encryption key, while the provider holds only the other portion. This segmentation allows the provider to offer storage services while the customer maintains control, as the provider cannot decrypt data without the customer's key portion.
Solution Approach 2:
The patent introduces a key management intermediary mechanism where the master key (held by the customer) acts as an intermediary between the customer's control requirements and the cloud storage system. This intermediary enables the cloud provider to store and manage encrypted data efficiently while the master key intermediary ensures customer control is maintained through cryptographic proof-of-possession verification.
Data Source
AI summary
A system for remotely storing data includes a communication component that is configured to receive a data file to be stored on a remote data storage system. An encryption system is configured to obtain at least one key and encrypt the data file with the at least one key. A processor is configured to generate a request to a master key storage system through the communication component to operatively encrypt the at least one key using a master key stored in the master key storage system. The communication component is configured to transmit the encrypted data file to at least one remote storage location. The processor is configured to receive the encrypted key(s) from the master key storage system and store the encrypted key(s) in a data store.