Trusted Cloud Data Processing via Key Extraction

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Data stored in public clouds is vulnerable to insider access and shared multi-tenant environments, with encryption key management being challenging due to the need to protect master keys and ensure regulatory compliance through dependable auditing mechanisms.

Innovation Solution

A system and method that encrypts data before uploading to the cloud, decrypts and processes it in a trusted environment, and re-encrypts the results, with key management functions retained by a client system's root key management server, using a key server module to provide cryptographic keys securely and manage access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data is stored in public cloud with encryption, then data security is improved, but key management complexity increases due to need to protect master keys and ensure regulatory compliance

Engineering Contradiction:
Improvedata securityVSAvoidkey management complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the master key from the cloud environment and keeps it exclusively in the customer's secure environment. The customer gateway server holds the master key locally and never transmits it to the cloud, separating key management responsibilities from the cloud provider and reducing key management complexity for the customer.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The customer gateway server acts as an intermediary between the customer's secure environment and the cloud service. It manages encryption keys locally, performs encryption/decryption operations, and controls key distribution to cloud services without exposing the master key, thereby simplifying key management while maintaining security.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If data is encrypted before uploading to cloud, then unauthorized access is prevented, but loss of control of data occurs complicating regulatory compliance

Engineering Contradiction:
Improveunauthorized access preventionVSAvoiddata control
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The customer's gateway server performs self-service by maintaining and managing encryption keys locally without requiring cloud provider assistance. The customer retains full control over key generation, storage, and distribution, enabling independent compliance with regulatory requirements while preventing unauthorized access through encryption.

Inventive Principle:
Principle #25Self-service

3Ease of operation

If key management is centralized in cloud, then ease of operation is improved, but security is reduced due to insider access vulnerability

Engineering Contradiction:
Improvekey management easeVSAvoidsecurity
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent segments key management responsibilities by separating the master key (kept in customer's secure environment) from data keys (managed in cloud for operational ease). This segmentation allows cloud services to access data keys for processing while the customer retains control of the master key, achieving both ease of operation and security.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP2974120B1Trusted data processing in the public cloud
Publication Date: 2017.09.27 INTEL CORP
  • EP2974120B1 patent drawingFigure 1
  • EP2974120B1 patent drawingFigure 2
  • EP2974120B1 patent drawingFigure 3

AI summary

Generally, this disclosure describes a system and method for trusted data processing in the public cloud. A system may include a cloud server including a trusted execution environment, the cloud server one of a plurality of cloud servers, a cloud storage device coupled to the cloud server, and a RKM server including a key server module, the RKM server configured to sign the key server module using a private key and a gateway server configured to provide the signed key server module to the cloud server, the trusted execution environment configured to verify the key server module using a public key related to the private key and to launch the key server module, the key server module configured to establish a secure communication channel between the gateway server and the key server module, and the gateway server configured to provide a cryptographic key to the key server module via the secure communication channel.