Proxy Server Encrypted Cloud Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based computing systems face vulnerabilities in data security, as cloud providers may access unencrypted data, and existing encryption methods either compromise processing capabilities or leave data vulnerable before encryption.
Innovation Solution
A system and method involving a proxy server that encrypts user data before sending it to a cloud-based processing server, allowing encrypted data to be processed without decryption, while maintaining user interface functionality and enabling secure data access control through different encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted on the cloud-based server, then data security is improved, but the cloud provider can still access unencrypted data before encryption and the processing capability is reduced
Solution Approach 1:
The system performs preliminary encryption action before data is sent to the cloud server. The client device encrypts the data locally using symmetric encryption, then sends only the encrypted data to the cloud server for processing. This preliminary encryption prevents the cloud provider from accessing unencrypted data while maintaining processing capabilities through encrypted data operations.
Solution Approach 2:
The system introduces an intermediary encryption layer between the client and cloud server. Data is encrypted on the client side before transmission, creating a security intermediary that prevents direct access to plaintext by the cloud provider. The cloud server processes encrypted data without needing to decrypt it, maintaining both security and processing capability.
2Reliability
If data is encrypted before sending to cloud server, then unauthorized access is prevented, but cloud-based processing capabilities are removed
Solution Approach 1:
The cloud server performs processing operations on encrypted data itself without requiring decryption. The system enables the cloud server to service encrypted data directly, applying operations such as search, filter, and sort on the encrypted form. This self-service capability allows encrypted data to be processed natively, maintaining cloud-based processing capabilities while preventing unauthorized access.
Solution Approach 2:
The system changes the state of data from plaintext to encrypted form before processing. By transforming the data parameter from unencrypted to encrypted state, the system enables secure processing where the cloud server operates on the encrypted data representation. This parameter change allows both unauthorized access prevention and cloud processing capabilities to coexist.
3Reliability
If traditional encryption is used on cloud servers, then data protection is improved, but the system complexity increases and performance is reduced
Solution Approach 1:
The system uses disposable symmetric encryption keys for data protection. Instead of complex asymmetric encryption infrastructure, the system employs simple symmetric keys that are generated, used, and discarded efficiently. This approach simplifies the encryption implementation while maintaining strong data protection, reducing both system complexity and performance overhead.
Data Source
Figure 1
Figure 2
AI summary
The present invention concerns a system and method for secure cloud computing. The cloud based processing system comprises a user interface, allowing a user to enter and edit data, a proxy server, and a cloud based processing server. The user interface sends data entered by a user to the proxy server, which sends the encrypted data to the cloud based processing server. The proxy server receives editing commands from the user interface, and sends those commands to the cloud based processing server along with the encrypted data. The cloud based processing server receives the encrypted data and editing commands, applies the editing commands to the encrypted data, and sends the edited encrypted data back to the proxy server.