Data at rest has long been protected by technology called public key infrastructure (PKI), in which data is encrypted when it’s created by a public key and only decrypted, in theory, by an authorised person holding the private key. But extending this type of data protection to the cloud can be complicated.
The migration to the cloud has introduced a new set of complex security issues for IT teams to manage due to the lack of direct control over the security of the data. Moreover, cloud providers believe that data security is a shared responsibility, where the service provider assures physical security and the subscribers must secure their servers and data. Presumably this would include a strategy for encryption and key management which requires that the keys be stored outside the cloud rather than in it.
Startup security company Porticor just released a solution that addresses the concern about data at rest in the cloud. Porticor offers a split key encryption solution where the cloud customer is the only one who knows the master key. What’s more, Porticor handles all the complexity of encrypting data so the customer barely needs to think about it. The security and convenience is all in the unique implementation of key management.
The fundamental problem of encrypting data in the cloud is where to store the keys. The customer can’t store the keys on a disk in the cloud because they could be vulnerable to hackers. The customer could allow a vendor to store its keys, but that means putting trust in a third party. The customer could bring the keys back into his own data centre, but that seems to defeat the purpose of outsourcing data centre services to the cloud. Porticor now offers an alternative for key management that is both simple and secure.
Porticor’s approach is based on the concept of the safe deposit box that has two keys — one for the customer and the other for the banker, or in this case, the Porticor Virtual Key Management Service. Just like the safe deposit box, the customer can’t decrypt the data without the key held by Porticor, and Porticor can’t decrypt the data without the master key held by the customer. In practice, the customer actually has one key per project, which is usually an application. Porticor has thousands of keys, one for each file or disk belonging to that project. Still, the keys must pair up in order to provide access to the encrypted data.
Beyond the keys being split between the customer and Porticor, the unique part of the solution is the keys themselves are encrypted by the customer’s master key, which only the customer holds and knows. As a result, Porticor holds project keys but the vendor can’t read them because they are encrypted. By encrypting the “banker” keys with the customer master key, Porticor gives the customer complete mitigation of end data protection. The customer must write down the master key and literally store it in a steel box. Once that is done, no one in the world other than the steel box ever sees the key. Another option is to put the master key in an escrow service.
Architecturally, the Porticor solution sits between the cloud based server and storage, ensuring that every bit of data between the servers and the storage is encrypted and every bit of data moving from storage to the servers is decrypted for customer initiated processes. The piece in the middle is the heart of the Portico solution, the Virtual Private Data (VPD) application. VPD is a virtual appliance that encrypts any disk or storage array with encryption algorithms such as AES-256. VPD retrieves the “banker” keys as well as requesting from the customer its key.
Porticor says this is military-grade security since only one party — the customer — holds the master key to unlock the data. (Hint: Don’t lose the master key or you’re up the creek without a paddle.) The master key only needs to be brought out of the steel vault when the entire server cluster is rebooted, which should be a rare occurrence. When new application servers are created, they inherit the encryption automatically through the VPD.
Security- and risk management-wise, the Porticor process does not save a “plain key” to any disk. Then, even if a hacker has penetrated the service provider’s network searching for data, the hacker will not see anything to steal.
The Porticor solution is designed to work with any cloud implementation. Today, Porticor has established partnerships with Amazon Web Services (AWS) and Red Hat, making the choices of those two services extra easy.
