Request-Supplied Encryption Keys for Provider-Isolated Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring secure access to computing resources and associated data across multiple networks and geographic boundaries is challenging, especially when infrastructure is managed by different organizations, as the service provider may have access to the encryption keys, risking data security.
Innovation Solution
The use of request-supplied cryptographic keys, where the service provider loses access to the keys after encryption, ensuring data security by controlling access with the customer maintaining key ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the service provider manages the encryption keys, then data access is convenient and fast, but data security is compromised because the service provider can decrypt the data
Solution Approach 1:
The patent extracts the encryption key from the service provider's control and places it under customer control. The customer generates and retains the encryption key, while only the encrypted data is stored with the service provider. This separation ensures the service provider cannot decrypt the data, resolving the security concern while maintaining operational convenience through automated key management interfaces.
Solution Approach 2:
The patent introduces an intermediary key management system that acts as a mediator between the customer and the service provider. This system handles key generation, storage, and rotation automatically, allowing the customer to maintain key control without manually managing cryptographic operations. The intermediary layer preserves data security while ensuring ease of operation through automated processes.
2Reliability
If the customer controls the encryption keys, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent implements self-service key management where the system automatically performs key generation, storage, rotation, and recovery operations without requiring manual customer intervention. The customer simply requests cryptographic operations through standard interfaces, and the system autonomously manages the complex key lifecycle operations, thereby maintaining security while reducing perceived complexity.
Solution Approach 2:
The patent creates a universal key management system that handles multiple cryptographic operations (encryption, decryption, key rotation, key recovery) through a single integrated interface. This multi-functional system consolidates various key management tasks into one cohesive service, reducing the overall complexity the customer must manage while maintaining robust security controls.
3Productivity
If encryption keys are stored with the service provider, then data processing efficiency is high, but the risk of security breaches increases
Solution Approach 1:
The patent extracts the encryption key from the service provider's storage environment and places it under customer control. Only the encrypted data remains with the service provider, eliminating the security risk associated with key storage while maintaining efficient data processing. The service provider can still perform cryptographic operations using the customer-provided keys without physically storing them.
Solution Approach 2:
The patent implements ephemeral key usage where encryption keys are temporarily provided for specific operations and then discarded or rotated. This approach allows efficient data processing during the key's brief lifecycle while minimizing security risk, as the keys do not persist in the service provider's environment long enough to be compromised. The system automatically generates, uses, and destroys keys in a controlled manner.
Data Source
AI summary
An encoding of a cryptographic key is obtained in a form of an encrypted key. Request is provided to a service provider including a fulfillment involving performing a cryptographic operation on data. Upon fulfillment of the request, a response is then received which indicates the fulfillment of the request.