Trusted Proxy Hybrid Data Storage Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party storage vendors face challenges in deduplicating and efficiently sharing encrypted data due to different encryption schemes used by customers, which interferes with their ability to provide services like data deduplication, sharing, and security scans.
Innovation Solution
Implementing a trusted proxy system that maintains asymmetric key pairs for encrypting and decrypting data, where the decryption keys are encrypted with client-side keys, allowing secure access to encrypted files while preventing unauthorized access and enabling deduplication and sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If customers encrypt data before submitting to third-party storage, then data security is improved, but the ability to deduplicate and share data is worsened
Solution Approach 1:
The encryption process is segmented into two distinct stages: (1) initial encryption by the customer using their own keys before upload, and (2) re-encryption by the proxy server using a standardized algorithm. This segmentation allows each party to maintain security control while enabling the third-party system to perform deduplication on the second encryption layer without compromising the original data security.
Solution Approach 2:
A proxy server is introduced as an intermediary between the customer and the third-party storage system. The proxy server receives encrypted data from customers, applies a standardized re-encryption layer, and stores the result. This intermediary enables the storage system to perform deduplication and sharing operations on the standardized layer while the customer's original encryption keys remain secure and unchanged.
2Reliability
If customers use different encryption schemes, then data security is improved, but the ability to share and access data is worsened
Solution Approach 1:
The proxy server implements a universal re-encryption mechanism that works with multiple customer encryption schemes. By applying a standardized encryption algorithm as a second layer, the system creates a universal interface that enables consistent data sharing and access operations across different customer encryption methods, while preserving the uniqueness and security of each customer's original encryption approach.
Solution Approach 2:
The encryption structure becomes composite, combining the customer's original encryption layer with a standardized proxy encryption layer. This composite structure allows the system to leverage both the customer-specific security measures and the standardized sharing mechanisms, enabling data sharing while maintaining diverse encryption schemes for security purposes.
3Adaptability or versatility
If third-party storage performs services on encrypted files, then service capability is improved, but data security is worsened
Solution Approach 1:
The sensitive decryption keys are extracted from the storage system and held exclusively by the customer and proxy server. The third-party storage system only stores and operates on encrypted data without access to decryption capabilities. This extraction allows the storage system to provide enhanced services on encrypted files while maintaining data security, as the keys necessary for decryption never reside on the third-party system.
Solution Approach 2:
The system enables self-service operations where the proxy server performs re-encryption and the storage system performs deduplication and sharing operations on the encrypted data without requiring decryption. This self-service approach allows service capabilities to be enhanced while maintaining security, as each component operates independently on the encrypted form of the data without exposing plaintext or keys.
Data Source
AI summary
The disclosed computer-implemented method for secure hybrid third-party data storage may include (1) identifying, at a trusted proxy system, an access request from a client system to access an encrypted file stored under a user account at a third-party storage system, where the requested access requires decryption of the encrypted file, (2) retrieving, from the third-party storage system, (i) the encrypted file and (ii) a decryption key that has been encrypted with a client-side key, where an asymmetric key pair designated for the user account includes an encryption key and the encrypted decryption key, (3) receiving, at the trusted proxy system, the client-side key, (4) decrypting, at the trusted proxy system, the decryption key with the client-side key, and (5) using the decryption key to access an unencrypted version of the encrypted file at the trusted proxy system. Various other methods, systems, and computer-readable media are also disclosed.