Private Cloud Data Encryption via Distributed Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data security in data centers remains a challenge as hackers can still access sensitive information despite existing security systems, particularly on private cloud platforms.
Innovation Solution
A method and apparatus that encrypt sensitive information using a local key previously encrypted by a master key stored off-premises, where the encrypted local key is sent to the off-premises system for decryption, and the decrypted local key is used to decrypt a secret key for encrypting and storing the sensitive information, ensuring robust protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive information is stored on private cloud platforms with existing security systems, then data accessibility and operational efficiency are improved, but security reliability deteriorates as hackers can still access the data
Solution Approach 1:
The encryption key is divided into multiple segments (first key portion stored on-premises, second key portion stored off-premises). Both segments are required to decrypt the sensitive information, so even if one segment is compromised, the full data remains secure. This segmentation resolves the contradiction by maintaining data accessibility through distributed storage while improving security reliability through multi-factor key control.
Solution Approach 2:
A key encryption key (KEK) acts as an intermediary layer between the encryption key segments and the sensitive information. The KEK encrypts both key portions, adding an additional security layer. This intermediary mechanism allows the system to maintain operational efficiency while significantly enhancing security reliability, as attackers must compromise multiple layers including the KEK itself.
2Reliability
If encryption keys are distributed across multiple locations to enhance security, then security reliability is improved, but device complexity increases
Solution Approach 1:
The key encryption key (KEK) serves multiple functions: it encrypts both the first and second key portions, manages key distribution between on-premises and off-premises systems, and provides a unified decryption mechanism. This multi-functionality reduces system complexity by consolidating key management operations into a single versatile component rather than requiring separate mechanisms for each function.
Solution Approach 2:
The encryption key is pre-divided into segments and pre-encrypted with the KEK before being distributed to different locations. This preliminary action simplifies the overall system architecture by establishing a clear, predetermined key management structure, reducing the complexity of real-time key handling and distribution operations.
3Reliability
If a local key is encrypted by a master key stored off-premises and used to decrypt secret keys, then security reliability is improved, but loss of time increases due to additional decryption steps
Solution Approach 1:
The local key is pre-encrypted with the master key and stored securely before needed. When decryption is required, the system retrieves the pre-prepared encrypted local key and decrypts it using the master key, which is faster than generating and managing multiple temporary encryption layers. This preliminary preparation reduces the time loss while maintaining high security reliability.
Solution Approach 2:
The system implements automated key management where the encrypted local key automatically retrieves and uses the master key for decryption without manual intervention. This self-service mechanism minimizes the time overhead by eliminating manual key management steps while maintaining the security benefits of multi-layer encryption.
Data Source
AI summary
A method for securing customer sensitive information on private cloud platforms includes receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The method includes sending the encrypted local key to the off-premises computing system for decryption, and receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system. The decrypted local key is decrypted from the received encrypted local key. The method includes decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.