Cloud Data Extraction via Signed Encryption and Intermediary Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a cloud environment, there is a need to balance the conflicting objectives of maintaining confidentiality of analysis data and source code between a cloud customer and an assurance administrator, where the assurance administrator extracts analysis data from the cloud customer's tenancy while ensuring the cloud customer maintains control over the extraction process and prevents leakage of sensitive information.
Innovation Solution
A signature and encryption (SE) service is deployed within a transmission zone to encrypt and sign analysis data, with metadata indicating the amount of source code, and an intermediate zone verifies the signature to allow passage only if the data is below a threshold, while the SE service maintains a log of the data and is designed to be ephemeral to prevent leakage through side channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the assurance administrator extracts analysis data from the cloud customer's tenancy, then the assurance administrator can perform security analysis and monitoring, but the cloud customer loses control over the data extraction process and risks leakage of sensitive source code information
Solution Approach 1:
The system segments the data extraction process into multiple independent components: the SE service encrypts and signs data, the intermediate zone verifies signatures and enforces thresholds, and the reception service receives only approved data. This segmentation ensures that no single component has full access to both the encryption keys and the ability to extract arbitrary data, thereby preventing information leakage while maintaining security analysis capability.
Solution Approach 2:
The intermediate zone acts as a trusted intermediary between the SE service and the reception service. It verifies the digital signatures on metadata, enforces source code threshold policies, and controls the passage of data. This intermediary mechanism allows the assurance administrator to monitor and control the extraction process without directly accessing the encryption keys or sensitive data, thus preventing information leakage while maintaining oversight.
2Object-generated harmful factors
If the cloud customer maintains full control over data extraction, then sensitive information security is improved, but the assurance administrator cannot perform independent security analysis
Solution Approach 1:
The SE service performs preliminary encryption and signing of the metadata before the data leaves the customer's tenancy. The digital signature is created in advance using the customer's encryption key, which the assurance administrator cannot obtain. This preliminary action ensures that the metadata's integrity and confidentiality are established before transmission, allowing the assurance administrator to verify the signature without accessing the actual sensitive data.
Solution Approach 2:
The intermediate zone provides feedback to the reception service about whether the metadata passes the source code threshold verification. This feedback mechanism allows the assurance administrator to know whether data extraction is being performed and whether it complies with policies, without granting access to the actual sensitive information. The feedback loop maintains security analysis capability while preserving information security.
3Ease of operation
If the intermediate zone verifies the signature of encrypted data, then control over data extraction is improved, but the complexity of the system increases due to additional verification steps
Solution Approach 1:
The system extracts only the essential verification function from the intermediate zone: verifying the digital signature on the metadata and checking the source code threshold. It does not attempt to decrypt or analyze the actual data content. This extraction of the verification function allows for a relatively simple implementation that provides effective control without requiring complex decryption or data analysis capabilities in the intermediate zone.
4Loss of information
If the SE service maintains a log of the data, then auditability and control are improved, but the risk of side channel leakage of sensitive information increases
Solution Approach 1:
The SE service performs preliminary encryption of the data before logging any metadata about it. The log contains only encrypted or signed metadata (such as file names, sizes, and thresholds) rather than the actual sensitive data content. This preliminary encryption action ensures that even if the log is accessed, the sensitive information remains protected, providing auditability without creating side channel leakage risks.
Data Source
AI summary
Techniques for transmitting data within a cloud environment are disclosed. Data is received by a transmission service, which transmits the data to a signature and encryption (SE) service, along with an encryption key. Signed and encrypted data, which is received from the SE service, is (i) encrypted using the encryption key and (ii) signed by the SE service. In an example, the SE service maintains a log of the data. The signed and encrypted data is transmitted to an intermediate zone, to facilitate the intermediate zone to verify a signature of the signed and encrypted data, and allow passage of the signed and encrypted data to a reception service. The transmission and reception services are within a first tenancy and a second tenancy, respectively, of a cloud environment; and the intermediate zone is within one of the first tenancy or a third tenancy of the cloud environment.