Two-Key Encryption System for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-service providers may compromise data security by accessing, analyzing, or sharing user data, and some providers offer inadequate security measures, making stored data vulnerable to external attacks.
Innovation Solution
A two-key encryption system where user data is stored in an encrypted format, with the user possessing the decryption key, which can be remotely transmitted to the cloud-service provider in an encrypted communication, ensuring that the decryption key is not permanently stored within the provider's infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud-service providers store and manage user data in their infrastructure, then data accessibility and service functionality are improved, but data security and privacy protection deteriorate due to potential unauthorized access, data analysis, or sharing by the providers
Solution Approach 1:
The encryption key is segmented into two parts: a data encryption key (DEK) for encrypting user data and a key encryption key (KEK) held by the user for decrypting the DEK. This segmentation ensures that the cloud-service provider can store and process encrypted data without having access to the decryption capability, thus maintaining data security while enabling data accessibility.
Solution Approach 2:
The decryption capability (KEK) is extracted from the cloud-service provider's infrastructure and retained by the user. The DEK is stored in the cloud infrastructure but cannot be used without the user's KEK. This extraction prevents the provider from accessing or analyzing user data while still allowing the data to be stored and managed in their infrastructure.
2Reliability
If cloud-service providers implement strong security measures to protect user data, then data security is improved, but system complexity and operational overhead increase
Solution Approach 1:
The user performs the key encryption and decryption operations themselves using their own KEK. The cloud-service provider's system automatically handles the encryption of data using the DEK and the encryption of the DEK using the KEK without requiring complex security management infrastructure. This self-service approach maintains high security while minimizing system complexity.
3Ease of operation
If decryption keys are stored within cloud-service provider infrastructure for efficient data access, then data accessibility is improved, but security vulnerabilities increase due to potential key compromise or unauthorized access
Solution Approach 1:
The master decryption key (KEK) is extracted from the cloud-service provider's infrastructure and kept exclusively by the user. Only the encrypted DEK is stored in the cloud infrastructure, which is useless without the user's KEK. This extraction eliminates the security vulnerability of storing decryption keys in the provider's infrastructure while maintaining efficient data access through the DEK.
Solution Approach 2:
The DEK acts as an intermediary between the encrypted user data and the user's KEK. The DEK is stored in the cloud infrastructure for efficient data decryption, but it is itself encrypted using the user's KEK. This intermediary structure allows the cloud provider to store and process data efficiently without having access to the actual decryption capability, thus maintaining both accessibility and security.
Data Source
AI summary
In one example a processing device can receive an indication from a software application that an encrypted communication transmitted by a remote device is stored in a memory location. In response to receiving the indication, the processing device can retrieve the encrypted communication from the memory location, decrypt the encrypted communication using a first key to determine a decrypted version of the encrypted communication, and extract a second key from the decrypted version of the encrypted communication. The second key can be different from the first key. And the second key can be configured to decrypt a set of encrypted data stored in a non-volatile memory device that is accessible to the computing device.