Trusted Cloud Execution Architecture for User-Defined Security Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing architectures lack sufficient security measures to instill trust in users, particularly when data and program execution are managed by a third-party operator, as they do not provide adequate guarantees against unauthorized access or breaches.
Innovation Solution
A secure cloud computing architecture is implemented with a first space controlled by the user and a second space controlled by a third-party operator, featuring first and second security policies, a trust base with hardware and software components, and indicators of unauthorized access to ensure compliance with security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional cloud computing architectures are used to provide scalable computing resources, then productivity and accessibility are improved, but security vulnerabilities and data breach risks increase
Solution Approach 1:
The system segments data into multiple shares using secret sharing schemes, distributing them across different computing nodes. No single node possesses the complete data, thereby maintaining security while enabling scalable computation across distributed resources.
Solution Approach 2:
The system introduces trusted execution environments (TEEs) and secure enclaves as intermediary layers between users and cloud infrastructure. These intermediaries provide hardware-backed security boundaries that protect data during processing, allowing scalable computing without compromising security.
2Reliability
If data is encrypted to enhance security, then data protection is improved, but processing speed and computational efficiency deteriorate
Solution Approach 1:
The system performs cryptographic operations and data sharing setup in advance during system initialization. This preliminary action enables subsequent computations to proceed more efficiently without repeated cryptographic overhead, balancing security with processing speed.
Solution Approach 2:
The system uses homomorphic encryption techniques that allow computations to be performed on encrypted data copies without decryption. This enables secure processing where encrypted data can be manipulated mathematically to produce encrypted results, maintaining both security and computational efficiency.
3Productivity
If distributed computing nodes are added to increase scalability, then computing capacity is improved, but system complexity and coordination overhead increase
Solution Approach 1:
The system implements a universal protocol layer that handles security, coordination, and data management functions across all distributed nodes. This multi-functional protocol reduces the need for node-specific complexity and simplifies coordination as the system scales.
Solution Approach 2:
The system incorporates feedback mechanisms where nodes report their status, capacity, and security state to a coordination layer. This feedback enables dynamic load balancing and resource allocation, managing system complexity through automated responses to changing conditions rather than static complex configurations.
4Reliability
If access control is strengthened to protect sensitive data, then security is improved, but ease of operation and data accessibility deteriorate
Solution Approach 1:
The system implements dynamic access control policies that adapt based on user identity, context, and data sensitivity. Access permissions are not static but adjust in real-time based on security requirements and user credentials, maintaining strong security while enabling appropriate accessibility for authorized users.
Solution Approach 2:
The system applies different security measures and access control levels to different data segments and computing nodes based on their specific sensitivity requirements. Not all data requires the same level of protection, allowing optimized security that maintains accessibility where appropriate while providing enhanced protection where needed.
Data Source
Figure 1~2A
Figure 2B~3A
Figure 3B~3C
AI summary
The invention relates to secure cloud computing architecture comprising: a first data management and/or computer program execution space (A) in which the data management or program execution is controlled by a user; and a second data management and/or computer program execution space (B) in which the data management or program execution is controlled by a third-party operator, first security policies (PSA) applied to the data or execution of programs in the first execution space (A); second security policies (PSB) applied to the data or execution of programs in the second execution space (B); a security property (P) expected by the user, compliance with the first and second security policies guaranteeing a data management and/or computer program execution in accordance with this property (P); and a trusted computing base (TCB) guaranteeing, in the the absence of a violation, the application of the second security policies (PSB) in the management of the data and/or execution of the programs in the second execution space (B).