Secure Extraction of System Internal Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for extracting state information from computer systems in cloud environments lack end-user control and confidentiality, particularly in public cloud settings, where sensitive data is at risk of unauthorized access and exposure.
Innovation Solution
A computer-implemented method using a security engine to generate an extraction key inaccessible outside the engine, encrypting this key with a public encryption key, and then using it to encrypt and store system state information, allowing controlled decryption only upon request by the customer, ensuring vendor access is restricted and secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of repair
If state information is extracted and sent to vendor for fault analysis, then system troubleshooting capability is improved, but data confidentiality and customer privacy are compromised
Solution Approach 1:
The patent applies preliminary action by encrypting the extraction key with the customer's public key before the data extraction process. This pre-encryption ensures that even if the extraction key is compromised during transmission or storage, the vendor cannot decrypt the state information without the customer's private key, thus protecting confidentiality before the actual troubleshooting occurs
Solution Approach 2:
The patent introduces an encryption intermediary mechanism where the customer's public key serves as a mediator between the state information and the vendor. The encrypted extraction key acts as a controlled access layer that allows vendor access to troubleshooting data while maintaining customer control and confidentiality through cryptographic mediation
2Ease of operation
If extraction key is made accessible for vendor decryption, then data accessibility for maintenance is improved, but security control and customer authority are reduced
Solution Approach 1:
The system performs preliminary encryption of the extraction key with the customer's public key before providing it to the vendor. This advance cryptographic protection ensures that the vendor can access and use the extraction key for decryption operations without compromising security, as the key itself is already protected by the customer's cryptographic credentials
Solution Approach 2:
The patent creates a cryptographic copy of the extraction key that is encrypted with the customer's public key. This copied and encrypted version can be safely transmitted to and used by the vendor for maintenance operations, while the original unencrypted key remains securely stored in the customer's system, preserving both accessibility and security control
Data Source
AI summary
Secure extraction of state information of a computer system is provided. A method includes obtaining, by a security engine of a system, a public encryption key associated with a private decryption key; generating an extraction key that is inaccessible outside of the security engine; encrypting the extraction key with the public encryption key, to thereby obtain an encrypted extraction key; collecting state information of the system; encrypting the collected state information with the extraction key and storing the encrypted collected state information; and based on a request for access to the stored encrypted collected state information by a request for the extraction key, providing the extraction key to facilitate decryption of the stored encrypted state information.