Keystore Service for Cloud Encryption Key Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face security vulnerabilities as encryption keys are stored locally on servers, making them susceptible to unauthorized access if the server is removed from the data center's network.
Innovation Solution
Implementing a keystore service that uses a key encryption key (KEK) to encrypt files locally on a computing device, generating a key identification for the encrypted KEK, and storing this information in a network keystore service, while keeping the encryption key and key identification locally stored.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are stored locally on servers, then access speed and convenience are improved, but security is worsened as keys become susceptible to unauthorized access if the server is removed from the network
Solution Approach 1:
The patent extracts the encryption keys from the local server environment and stores them externally in a secure keystore service. The server only retains encrypted versions of keys and decryption capabilities, while the actual plaintext keys reside outside the server's control environment, eliminating the security vulnerability of local key storage while maintaining access functionality.
Solution Approach 2:
The patent introduces a keystore service as an intermediary component between the server and the encryption keys. This mediator manages key storage, retrieval, and rotation operations, allowing the server to access keys without directly holding them, thus balancing both security requirements and operational convenience.
2Reliability
If encryption keys are stored externally in a network keystore, then security is improved, but access complexity and operation difficulty increase
Solution Approach 1:
The keystore service implements self-service capabilities by automatically managing key lifecycle operations including generation, encryption, storage, retrieval, and rotation. The system handles security protocols and key management tasks autonomously without requiring manual intervention, thereby maintaining security while simplifying operational complexity for users.
Solution Approach 2:
The keystore service provides multiple functions within a single system: key generation, key encryption, secure storage, authenticated retrieval, and key rotation. This multi-functional approach consolidates what would otherwise require separate systems into one unified service, reducing overall operational complexity while maintaining high security standards.
3Reliability
If key encryption keys are encrypted and stored in the keystore, then security is improved, but decryption time and processing duration increase
Solution Approach 1:
The system performs preliminary actions by pre-generating and pre-encrypting keys before they are needed for actual data encryption operations. Keys are prepared in advance and stored in encrypted form in the keystore, allowing for optimized retrieval and decryption processes when needed, rather than performing key generation and encryption operations in real-time during data access.
Solution Approach 2:
The keystore service implements parameter changes by using different encryption algorithms and key formats optimized for specific operations. The system can adjust encryption parameters, key lengths, and algorithm selections based on security requirements and performance considerations, allowing balanced optimization between security strength and decryption speed for different operational contexts.
Data Source
AI summary
The present embodiments relate to a keystore service for encryption for a computing device of a cloud computing system. The computing device of the cloud computing system can receive a key identification, an encrypted key encryption key, an identity of a client device, and a request from the client device to store the key identification and the encrypted key identification key. The computing device can verify, based at least in part on the identity, an authority of the client device to store the key identification and encrypted key encryption key.The computing device can transmit, based at least in part on the verification, the key identification, the encrypted key encryption key, and request to store the key identification and the encrypted key encryption key to a keystore.