Storage Device Key Isolation for Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based storage systems face security vulnerabilities as they allow root-level access to service providers, enabling unauthorized access to data even when third-party administrators obtain root-level privileges.
Innovation Solution
Implementing a storage device with a communication interface, data storage media, and key storage media that uses a first key associated with a second key to restrict access, where the application server encrypts data using the second key and stores it in the storage device, preventing access even with root privileges by not providing the necessary key for decryption or authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based storage systems use conventional security techniques, then data is protected from third-party access, but root-level access is still permitted to service providers and third parties with root privileges
Solution Approach 1:
The patent extracts the key management function from the cloud service provider's control and places it in a hardware security module (HSM) within the storage device. This separation removes the ability of service providers and root users to access decryption keys, as the keys are generated and stored exclusively within the HSM, resolving the contradiction between maintaining service provider functionality and preventing unauthorized data access.
Solution Approach 2:
The HSM acts as an intermediary between the storage device and external systems. It mediates all cryptographic operations by generating keys internally and performing encryption/decryption without exposing the keys to external entities. This intermediary layer ensures that even with root privileges, no external party can access the keys, thus preventing unauthorized access while maintaining system functionality.
2Ease of operation
If service providers maintain root-level access for system management, then system administration is simplified, but data confidentiality is compromised
Solution Approach 1:
The patent segments access rights by creating distinct functional layers: the HSM handles key management and cryptographic operations with restricted access, while the cloud service provider maintains operational control over data storage and retrieval. This segmentation allows system administration to function normally while data confidentiality is protected by the HSM's key isolation, resolving the contradiction between administrative ease and data security.
3Device complexity
If encryption keys are stored externally to the storage device, then key management is simplified, but security is reduced due to potential access by root users
Solution Approach 1:
The patent implements nesting by placing the HSM within the storage device architecture. The HSM is a self-contained security module embedded in the storage device that generates and protects keys internally. This nested structure maintains relatively simple external key management (keys don't need to be transmitted or stored externally) while providing high security through the HSM's isolated key environment, resolving the contradiction between management simplicity and security.
Data Source
AI summary
Embodiments include a storage device, comprising: a communication interface; data storage media; key storage media; and control logic configured to: receive a first key associated with a second key through the communication interface; store the first key in the key storage media; and restrict access through the communication interface to data stored in the data storage media using at least one of the first key and the second key.