Streaming Encryption with Interval Key Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Collaborative online environments face security breaches due to inadequate encryption systems, making users hesitant to share sensitive documents, and there is a need for improved encryption and recovery methods to address these breaches.
Innovation Solution
The implementation of upload and download streaming encryption methods within a cloud-based platform, utilizing an Interval Key Server (IKS) with an encryption key pool to securely manage and redistribute encryption keys, ensuring secure file transfer and recovery in case of key compromises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption systems are used in cloud-based collaborative environments, then file sharing can be enabled, but security breaches occur due to inadequate encryption and key management
Solution Approach 1:
The encryption system is segmented into multiple independent components: client-side encryption modules, server-side encryption modules, and a key management system. Each component operates independently with specific encryption keys, so a breach in one segment does not compromise the entire system. The encryption keys are divided into different types (data encryption keys, key encryption keys) managed by different entities, creating segmented security layers.
Solution Approach 2:
The system performs preliminary encryption actions before data is stored in the cloud. Files are encrypted on the client device before upload, and encryption keys are prepared and managed in advance through the key management system. This preliminary encryption ensures that data is protected from the moment it enters the cloud environment, preventing security breaches before they can occur.
2Ease of manufacture
If encryption keys are statically managed, then key management is simple, but compromised keys cannot be recovered and all files become vulnerable
Solution Approach 1:
The key management system transitions from static key management to dynamic key rotation. The system automatically generates new encryption keys periodically and enables seamless key rotation without interrupting file access. When keys are compromised, the system can dynamically issue new keys and update encrypted files, maintaining continuous security while simplifying key management through automated processes.
Solution Approach 2:
The system implements a mechanism to discard compromised keys and recover access to encrypted files. When a key is determined to be compromised, the system discards the compromised key and generates replacement keys. The key management system tracks which files were encrypted with which keys, enabling selective decryption and re-encryption with new keys, thus recovering security without affecting the simplicity of key management.
3Reliability
If streaming encryption is implemented during upload and download, then data protection is enhanced, but processing time and computational resources increase
Solution Approach 1:
Files are encrypted on the client device before upload to the cloud, so encryption processing is completed in advance during the upload process rather than requiring additional time during storage or access operations. This preliminary encryption action ensures data protection is established before data enters the cloud environment, minimizing the impact on overall system performance.
Solution Approach 2:
The encryption process is integrated continuously into the upload and download streams rather than being separate discrete operations. As data flows through the upload and download processes, encryption and decryption operations occur concurrently, maintaining continuous protection without significant interruptions to data transfer speed. The key management system operates continuously in the background to support key rotation and distribution.
Data Source
AI summary
Embodiments of the present disclosure include systems and methods for upload and/or download streaming encryption to/from an online service, or cloud-based platform or environment. The encryption process includes the following parts: Upload encryption, download decryption, and a central piece of infrastructure called the Interval Key Server (IKS). During both upload and download, the encryption and decryption processes are performed while the files are being uploaded/downloaded, (e.g., the files are being encrypted/decrypted as they are being streamed).