MPC Key Management to Block Cloud Provider Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud providers often have access to encryption keys, making data vulnerable to breaches and unauthorized access, and existing key management systems are inadequate for ensuring data security and integrity, particularly when transitioning between providers.
Innovation Solution
Implementing a multi-party computation (MPC) system with secure cryptoprocessors to manage encryption keys, where data is decrypted using MPC responses from multiple servers without revealing sensitive information, ensuring secure key management and minimizing exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud provider stores encryption keys with data, then data can be encrypted at rest, but cloud provider can access and read secure files
Solution Approach 1:
The encryption key is divided into multiple secret shares that are distributed across different locations and parties. The data can only be decrypted when sufficient shares are collected through threshold cryptography, preventing any single entity including the cloud provider from accessing the data alone.
Solution Approach 2:
A third-party decryption service acts as an intermediary between the cloud provider and the encrypted data. This service holds the decryption capability but operates independently, requiring additional authentication factors beyond what the cloud provider alone possesses.
2Reliability
If end-to-end encryption with zero-knowledge authentication is used, then data remains secure during breach, but cloud provider employees cannot access data
Solution Approach 1:
The system implements dynamic access control where decryption rights are not static but can be granted, revoked, or limited based on operational needs. Temporary decryption keys or time-limited access tokens can be issued to authorized users without compromising the long-term security of the encrypted data.
Solution Approach 2:
Instead of requiring complete knowledge of the encryption key for all operations, the system allows partial decryption capabilities through share-based access. Users can be granted access to specific shares or portions of the decryption process sufficient for their operational needs without full key exposure.
3Ease of manufacture
If cloud provider holds encryption keys, then data can be encrypted and stored, but organization cannot ensure data protection when leaving provider
Solution Approach 1:
The decryption capability is extracted from the cloud provider's control and distributed to multiple independent parties or entities. This allows the organization to maintain data protection even if the cloud provider relationship ends, as the decryption shares remain with the organization or its designated parties.
Solution Approach 2:
The system establishes and distributes decryption shares before data is actually accessed or before organization leaves the provider. This preliminary distribution ensures that when transition occurs, the organization already possesses the necessary components to decrypt and migrate its data without relying on the cloud provider's continued key management.
Data Source
AI summary
Provided are computer implemented systems, methods, and computer program products for secure key management, including receiving, by a remote data storage service, a request for data stored as encrypted data by the remote data storage service, the request initiated by a first entity, transmitting, to a first multi-party computation (MPC) server controlled by the first entity, an MPC request, receiving an MPC response from the first MPC server including a secret generated by a secure cryptoprocessor, and decrypting the encrypted data based at least partially on the MPC response. The computer implemented systems, methods, and computer program products may include blocking at least one of a subsequent MPC request from the data storage service, a subsequent MPC response to the data storage service, a link, or a connection between the data storage service and an MPC server computer of the entity to prevent decryption.