Third-Party Data Storage Encryption with Internal Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in maintaining the confidentiality of sensitive data when storing it on third-party servers, as they need to balance security with ease of access for employees while adhering to regulatory compliance and preventing unauthorized access by the third-party provider.
Innovation Solution
The solution involves encrypting data with a key stored internally, associating metadata with the encrypted data on the third-party server, and using this metadata to locate and decrypt the data within the organization's internal network, ensuring that the third-party server does not have access to the decryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If data is stored on a third-party server, then storage cost and functionality are improved, but data confidentiality and security are worsened
Solution Approach 1:
The data is segmented into encrypted portions that are stored on the third-party server, while the decryption keys remain segmented and stored separately within the organization's internal network. This segmentation ensures that even if the third-party server is compromised, the actual data remains confidential without the keys.
Solution Approach 2:
Encryption algorithms act as intermediaries between the organization's data and the third-party server storage system. The data is transformed into encrypted form through this intermediary process before being stored externally, maintaining confidentiality while enabling third-party storage functionality.
2Object-affected harmful factors
If data is encrypted and stored on a third-party server, then data confidentiality is improved, but access efficiency and ease of operation are worsened
Solution Approach 1:
The data is pre-encrypted with appropriate keys before being stored on the third-party server, and metadata is pre-associated with the encrypted data to indicate key locations. This preliminary action ensures that when data needs to be accessed, the decryption process can proceed efficiently without delays.
Solution Approach 2:
Metadata associated with the encrypted data provides feedback information about key locations and decryption requirements. This feedback mechanism enables the system to efficiently retrieve and apply the correct keys for decryption, maintaining access efficiency despite the encryption overhead.
3Reliability
If encryption keys are stored internally, then data security is improved, but system complexity and device complexity are worsened
Solution Approach 1:
The decryption keys are extracted from the data storage system and placed in a separate key management location within the organization's internal network. This extraction simplifies the third-party server's role to only storing encrypted data, while the key management complexity is isolated to the organization's own infrastructure.
Solution Approach 2:
The key management system operates in a different dimensional space than the data storage system. Keys are stored in a separate namespace and location dimension within the internal network, allowing independent management and reducing the complexity coupling between data storage and key management.
Data Source
AI summary
Methods and systems for maintaining the confidentiality of data provided by an organization for storage on a third party database system are provided. The data can be encrypted on an internal network of the organization and sent to the third party database system for storage. The third party database system can associate metadata with the encrypted data and can store the encrypted data. Accordingly, when a request for the encrypted data is received from a computing device communicating with an internal network of the organization, the encrypted data and associated metadata can be sent to the computing device. A key that is stored on an internal network of the organization can be called through an applet, which utilizes information within the metadata to locate the key on the internal network of the organization.