Trusted Multi-Cloud Scheduling for Secure AK/SK Handling

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Multi-cloud services face challenges in ensuring the credibility and security of user identifiers and information due to the unequal cost-benefit ratio and the need for strict security measures, particularly in handling sensitive information like Access Key Id (AK) and Secret Access Key (SK).

Innovation Solution

Implementing a trusted execution environment (TEE) to process multi-cloud scheduling instructions and information, ensuring confidentiality and integrity by handling sensitive information within a tamper-resistant environment, and using a hardware-based security mechanism to manage and secure the processing of schedule-required information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user identifiers and information are used for encryption in multi-cloud service, then the security and credibility requirement is improved, but the device complexity and security measure requirements worsen

Engineering Contradiction:
Improvecredibility of multi-cloud serviceVSAvoidsecurity measure complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a trusted execution environment (TEE) as an intermediary component between the multi-cloud service system and user information. The TEE acts as a secure mediator that handles encryption and decryption operations, isolating sensitive cryptographic operations from the main system. This resolves the contradiction by providing enhanced credibility through a dedicated security intermediary while managing complexity through modular architecture rather than distributed security measures across the entire system.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the system into distinct functional modules: a multi-cloud service system, a trusted execution environment, and separate processing components for scheduling instructions and user information. By dividing the system into isolated segments with clearly defined interfaces, the patent enhances credibility through specialized security zones while managing overall system complexity through modular design. The TEE segment specifically handles sensitive operations, preventing complexity from propagating throughout the entire system.

Inventive Principle:
Principle #1Segmentation

2Reliability

If sensitive information like Access Key Id and Secret Access Key is processed in multi-cloud service, then the security requirement is improved, but the ease of operation worsens

Engineering Contradiction:
Improvesecurity of sensitive informationVSAvoidoperation simplicity
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The trusted execution environment automatically performs encryption and decryption operations without requiring manual intervention from users or administrators. The TEE self-manages sensitive cryptographic operations, including automatic key management and secure information handling. This resolves the contradiction by providing high security through automated cryptographic operations while maintaining ease of operation, as users interact with simplified interfaces rather than complex security procedures.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The TEE serves as an intermediary that shields users from complex security operations. Instead of requiring users to manually manage cryptographic keys and encryption processes, the TEE intermediary automatically handles these operations in the background. This maintains ease of operation for end users while implementing robust security measures through the intermediary's automated cryptographic processing.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If trusted execution environment is used to process scheduling instructions, then the credibility and transparency are improved, but the device complexity worsens

Engineering Contradiction:
Improvecredibility and transparency of schedulingVSAvoidsystem architecture complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The trusted execution environment acts as a specialized intermediary component that handles scheduling instruction processing in an isolated, secure manner. Rather than implementing complex security measures throughout the entire system architecture, the TEE intermediary provides enhanced credibility and transparency specifically for scheduling operations. This localized approach improves scheduling credibility without proportionally increasing overall system complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies enhanced security and transparency measures locally to the trusted execution environment and scheduling processing components, rather than uniformly across the entire system. The TEE provides high-assurance processing specifically where scheduling decisions are made, while other system components maintain standard operational complexity. This local quality approach enhances scheduling credibility without unnecessarily increasing device complexity throughout the entire system.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS12549551B2Method and apparatus for processing multi-cloud service, electronic device and storage medium
Publication Date: 2026.02.10 BEIJING YOUZHUJU NETWORK TECH CO LTD
  • US12549551B2 patent drawing
  • US12549551B2 patent drawing
  • US12549551B2 patent drawing

AI summary

A method and an apparatus for processing a multi-cloud service, an electronic device, a storage medium and a system are provided. The method includes acquiring a target multi-cloud scheduling instruction, where the target multi-cloud scheduling instruction includes a multi-cloud scheduling demand and description of schedule-required information; transmitting an application for the schedule-required information to a target user in a trusted environment based on the description of the schedule-required information, to obtain the schedule-required information; generating a scheduling strategy in the trusted environment based on the target multi-cloud scheduling instruction and the schedule-required information; and initiating scheduling to a target cloud vendor based on the scheduling strategy to obtain a scheduling result.