Multi-Cloud Data Partitioning with Reversible Coding for Secure Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems for highly-sensitive data, such as electronic medical records, are vulnerable to data breaches in public clouds, with the responsibility for protection lying with the user rather than the cloud service provider, and compliance standards focusing on monitoring and auditability rather than adequate protection.
Innovation Solution
A multi-cloud environment is used to enhance data security by encoding and partitioning sensitive data using reversible coding techniques like linear network coding, distributing encoded parts across different cloud providers, and employing proxy re-encryption to further secure the data, while maintaining client control over decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is stored in public cloud storage systems, then data accessibility and storage capacity are improved, but data security and vulnerability to breaches deteriorate
Solution Approach 1:
The patent divides sensitive data into multiple encoded fragments using reversible coding techniques and distributes these fragments across multiple cloud service providers. No single provider holds the complete data, so even if one provider is compromised, the full data cannot be reconstructed without additional fragments from other providers.
Solution Approach 2:
The patent introduces an infrastructure service as an intermediary that manages the encoding, distribution, and retrieval coordination of data fragments across multiple cloud providers. This intermediary layer abstracts the complexity of multi-cloud management and implements security policies without requiring direct user intervention.
2Reliability
If data is encrypted and stored in cloud systems, then data protection is improved, but compliance with monitoring and auditability standards deteriorates
Solution Approach 1:
The infrastructure service automatically manages encoding, fragment distribution, retrieval coordination, and decryption without requiring manual user intervention. The system self-manages the complex security operations while maintaining auditability through automated logging and tracking of data access and operations.
3Reliability
If data is partitioned and distributed across multiple cloud providers, then security against single-point compromise is improved, but system complexity and management overhead increase
Solution Approach 1:
The infrastructure service provides a universal interface that handles multiple functions including encoding, distribution, retrieval, and decryption across different cloud providers. This single service manages the complexity of multi-cloud operations, presenting a simplified interface to users while handling the intricacies of fragment management across multiple providers.
Data Source
AI summary
Using reversible coding (e.g., linear network coding) to encode and partition sensitive data before storing the different encoded partitions in a distributed manner among different public cloud providers' storage systems is disclosed. The sensitive data is normally encrypted when first received, whereby the initial security is increased via the use of linear network coding. To retrieve the data, the encoded data parts are collected from among the disparate storages, and reconstituted, including via inverse encoding for returning to a client request. A proxy re-encryption service can further be leveraged to re-encrypt the encrypted data before or after encoding into the partitions. Data protection and availability can be integrated with the system by maintaining multiple redundant (e.g., differently encoded) copies of the encoded parts and/or recovery fragments among the various public cloud providers' storage systems.