Trusted Cloud Data Processing via Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data stored in public clouds is vulnerable to insider access and shared multi-tenant environments, with encryption key management being challenging due to the need to protect master keys and ensure regulatory compliance through dependable auditing mechanisms.
Innovation Solution
A system and method that encrypts data before uploading to the cloud, decrypts and processes it in a trusted environment, and re-encrypts the results, with key management functions retained by a client system's root key management server, using a key server module to provide cryptographic keys securely and manage access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in public cloud with encryption, then data security is improved, but key management complexity increases due to need to protect master keys and ensure regulatory compliance
Solution Approach 1:
The patent extracts the master key from the cloud environment and keeps it exclusively in the customer's secure environment. The customer gateway server holds the master key locally and never transmits it to the cloud, separating key management responsibilities from the cloud provider and reducing key management complexity for the customer.
Solution Approach 2:
The customer gateway server acts as an intermediary between the customer's secure environment and the cloud service. It manages encryption keys locally, performs encryption/decryption operations, and controls key distribution to cloud services without exposing the master key, thereby simplifying key management while maintaining security.
2Reliability
If data is encrypted before uploading to cloud, then unauthorized access is prevented, but loss of control of data occurs complicating regulatory compliance
Solution Approach 1:
The customer's gateway server performs self-service by maintaining and managing encryption keys locally without requiring cloud provider assistance. The customer retains full control over key generation, storage, and distribution, enabling independent compliance with regulatory requirements while preventing unauthorized access through encryption.
3Ease of operation
If key management is centralized in cloud, then ease of operation is improved, but security is reduced due to insider access vulnerability
Solution Approach 1:
The patent segments key management responsibilities by separating the master key (kept in customer's secure environment) from data keys (managed in cloud for operational ease). This segmentation allows cloud services to access data keys for processing while the customer retains control of the master key, achieving both ease of operation and security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Generally, this disclosure describes a system and method for trusted data processing in the public cloud. A system may include a cloud server including a trusted execution environment, the cloud server one of a plurality of cloud servers, a cloud storage device coupled to the cloud server, and a RKM server including a key server module, the RKM server configured to sign the key server module using a private key and a gateway server configured to provide the signed key server module to the cloud server, the trusted execution environment configured to verify the key server module using a public key related to the private key and to launch the key server module, the key server module configured to establish a secure communication channel between the gateway server and the key server module, and the gateway server configured to provide a cryptographic key to the key server module via the secure communication channel.