Security Service Provider for Client-Side Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems that encrypt data on the client-side face limitations in allowing modifications and previews of encrypted data within online applications, as cloud service providers cannot decipher or recognize encrypted formats, leading to disabled functionalities.
Innovation Solution
A communication system that includes a client device, a cloud service provider, and a security service provider, where the security service provider acts as a proxy to decrypt and re-encrypt client-side encrypted data, enabling viewing and modification through an in-browser web application while synchronizing changes back to the cloud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client-side encryption is implemented to secure data, then data security is improved, but cloud service provider functionalities (editing, previewing) are disabled
Solution Approach 1:
The patent introduces a security service provider as an intermediary between the client device and cloud service provider. This intermediary decrypts data using client-provided encryption keys, enabling the cloud service provider to access and process decrypted data for editing and previewing functionalities, while the client retains control over encryption keys and data security.
2Object-affected harmful factors
If data is encrypted on client-side before upload, then unauthorized access is prevented, but the cloud service provider cannot recognize or process the encrypted data
Solution Approach 1:
The security service provider acts as a mediator that receives encrypted data from the client, decrypts it using client-provided keys, and forwards the decrypted data to the cloud service provider for processing. This enables the cloud service provider to perform editing, previewing, and other data processing operations on decrypted data while the client maintains security control through key management.
3Reliability
If encryption keys are managed exclusively by the client, then data confidentiality is maximized, but cloud-based collaboration and modification features are limited
Solution Approach 1:
The security service provider intermediary enables multiple clients to collaborate on encrypted data by managing decryption and re-encryption operations. When collaborative editing is needed, the intermediary temporarily decrypts data for authorized users, processes their modifications, and re-encrypts the updated data, maintaining confidentiality while enabling productive collaboration.
Solution Approach 2:
The system performs preliminary decryption and processing of encrypted data before it needs to be accessed or modified by cloud services or multiple users. The security service provider prepares the data in an accessible format temporarily, performs necessary operations, then re-encrypts it, allowing efficient collaboration without compromising long-term security.
Data Source
AI summary
Particular embodiments described herein provide for a system that can be configured to receive a notification that a client device is requesting, to modify original data associated with an online application, wherein the original data is stored in encrypted format in a cloud; decrypt the original data using a first client encryption key; store the decrypted data in a location accessible by the online application; enable editing capability of the decrypted data; receive a notification that the client device is finished modifying the data in decrypted format; determine whether the original data in decrypted format was modified; encrypt, based on a determination that the original data was modified, the modified data using a second client encryption key; and upload the modified data in encrypted format to the cloud.