Server Encryption Infrastructure for Administrator Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, administrators have access to data storage systems, posing a risk of data interception and unauthorized access, especially in public cloud setups where different legal entities are involved, and existing security measures rely on trust and behavioral compliance rather than technical safeguards.
Innovation Solution
Implementing an encryption/decryption infrastructure on the server computer with a forwarder module, crypto module, and key control module that exchanges and secures data between client and server computers, ensuring data is encrypted only when necessary and using a key trigger from the client computer to manage encryption keys, minimizing key exposure and communication between modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If administrators are given access to the data storage system for maintenance and management purposes, then system operational efficiency is improved, but data security and confidentiality deteriorate due to potential data interception and unauthorized access
Solution Approach 1:
The patent introduces an encryption layer as an intermediary between administrators and stored data. Data is encrypted using encryption keys that are themselves encrypted with administrator-specific public keys. This mediator mechanism allows administrators to access the storage system for maintenance while the encryption layer prevents them from reading actual data content, thus resolving the contradiction between operational access and data security.
2Reliability
If encryption infrastructure is deployed to protect data from administrator access, then data security is improved, but system complexity increases due to additional encryption/decryption operations
Solution Approach 1:
The patent implements preliminary action by pre-generating encryption keys and pre-encrypting data before administrators can access it. The encryption infrastructure is set up in advance with key pairs generated for each administrator, and data is encrypted using these keys before storage. This preliminary preparation reduces the complexity of real-time encryption operations during administrator access, as the heavy cryptographic work is done beforehand.
3Reliability
If data is encrypted at all times to prevent administrator interception, then data confidentiality is improved, but processing speed and access efficiency deteriorate due to continuous encryption/decryption requirements
Solution Approach 1:
The patent applies local quality by differentiating the treatment of different data portions. Not all data requires the same level of encryption overhead. The system encrypts data using administrator-specific keys locally at the point of storage, and administrators can access their own encrypted data without requiring decryption by other administrators. This localized encryption approach improves processing speed by avoiding unnecessary global decryption/ re-encryption operations while maintaining confidentiality.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
For storing data in a data-storage structure (152) of a server computer (102), an infrastructure (192) is deployed to a server computer (102). The infrastructure (192) has a forwarder module (122) to receive data (D2) from an application (112) and to identify a data portion (P), a crypto module (132) to encrypt the data portion (P) with a key (KY) and key control module (142) adapted to generate and to store (222) the key (KY). The infrastructure is also able to process data in the opposite direction. The key is provided (220) into the key control module (142) upon receiving a key trigger (KT) from the client computer (101).