Streamed Cloud Object Uploads With Customer-Controlled Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face issues with data security, long latency, handling of large or unknown-sized files, and inefficient storage management, including concerns over data theft and storage limitations.
Innovation Solution
Implementing a cloud object store with unique encryption keys for each digital object, using AES 256-bit encryption, and managing keys through customer-controlled security modules to ensure secure and efficient storage and retrieval of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data is stored in cloud computing systems, then storage capacity is improved, but data security and protection against unauthorized access deteriorate
Solution Approach 1:
The patent segments encryption keys into multiple parts distributed across different cloud service providers. No single provider has access to the complete key, making it impossible for them to decrypt customer data independently. This segmentation maintains cloud storage capacity while enhancing security through distributed key management.
Solution Approach 2:
The patent introduces a customer-controlled key management system as an intermediary between the customer and cloud service providers. This intermediary holds and manages the encryption keys, ensuring that cloud providers can store data but cannot access it without customer authorization. This resolves the contradiction by adding a security layer that doesn't reduce storage capacity.
2Reliability
If cloud service providers implement strong security measures, then data protection is improved, but response time and latency worsen
Solution Approach 1:
The patent implements preliminary encryption of data before it is uploaded to cloud storage. Since encryption is performed client-side before transmission, the cloud service providers receive already-encrypted data and can perform storage operations without decryption overhead. This preliminary security measure doesn't impact cloud response time for storage operations.
Solution Approach 2:
The system enables self-service encryption where customers encrypt their own data using their private keys before uploading to the cloud. This eliminates the need for cloud providers to implement time-consuming encryption processes, maintaining fast cloud response times while ensuring strong data protection through customer-controlled encryption.
3Productivity
If file size constraints are imposed on clients, then storage management efficiency is improved, but handling of large files and flexibility deteriorate
Solution Approach 1:
The patent implements a universal encryption framework that works with files of any size without requiring different processing approaches. The client-side encryption mechanism handles both small and large files uniformly, allowing the cloud storage system to manage files of any size efficiently without imposing constraints on clients. This universal approach maintains storage management efficiency while greatly enhancing flexibility for large file handling.
Data Source
AI summary
Methods in a cloud object store facilitate strong data encryption, customer-management of object (encryption) keys, reductions in latency, globally-distributed object storage, and handling of streamed uploads. A method for encrypting objects stored in a cloud includes encrypting each object with a unique encryption (object) key. The plaintext object keys are generated in advance of uploads. The plaintext object keys can be stored in an object database in the cloud. Alternatively, the plaintext object keys can be provided to a customer's HSM, encrypted, and returned to the cloud, such that encrypted object keys, encrypted by the customer, are stored in the cloud. The cloud can alternatively encrypt the customer's object keys with a master key for the customer, which is then encrypted by the customer's HSM before being stored in the cloud. Proxies are also deployed for efficiently communicating with customer security modules.