Risk
12/21/2012
07:14 PM
Connect Directly
RSS
E-Mail
50%
50%

Protecting Data In The Cloud Without Making It Unusable

Encrypting data in the cloud is an important security step, but without the proper handling, it can make processing the data -- from searching to number crunching -- much more difficult

Encryption in the cloud is about preventing outside hackers and external partners -- even the cloud provider themselves -- from accessing a company's private data. However, companies tend to shy away from scrambling their data because, in the past, making the data unreadable to others also disrupted the business.

With encryption, usability is usually the quality that companies have to sacrifice. Employees either have to use special tools to access the data or lose the ability to perform necessary business operations without downloading and decrypting significant portions of the data set.

"The thinking has been that encryption messes with your data -- you can't do operations on it -- and key management is very hard," says Pravin Kothari, founder and CEO of cloud-security firm CipherCloud.

As security firms start to create technologies to secure data in the cloud, they have addressed businesses' primary concern: Not how much security the technology will provide, but whether it will get in the way. While companies have sought out encryption solutions to increase security, meet compliance obligations, and abide by national data residency requirements, many balked because most encryption experts never really thought about usability, says Terence Spies, chief technology officer of Voltage Security.

"People in the crypto world tend to get obsessed with how many bits of protection, but what became evident is that usability and the ability to work with existing business processes is the major determining factor in how much adoption you are going to get," Spies says.

Take a simple property like the storage allocated for data in a database field. Encryption typically expands a piece of text -- or plaintext -- to a certain block size when it turns it into an encrypted format, or ciphertext. This can be a problem if the cloud application expects a relatively short string -- say, a last name -- to be only a score of characters. Typical encryption could make the string too long to fit in the allocated space.

To fix the problem with fitting ciphertext into limited database fields, companies such as Voltage have designed format-preserving encryption that can turn plaintext of a maximum length into a string of ciphertext with the same number of digits. The transformation sacrifices no security, says Spies.

"You've taken a whole class of applications and made them able to operate without needing to get access to keys that would expose the entire data," he says.

Yet using format-preserving encryption does not solve a number of other problems. Encryption also breaks any sort of ordering, and encrypted numbers cannot be added, subtracted, or multiplied in any meaningful way.

[Encrypting data is one of the most basic -- and most effective -- data security measures we have at our disposal, but when used with relational databases, encryption creates two major problems. See A Look At Encrypted Query Processing.]

To support searching, sorting, and other operations requires the security gateway to perform some behind-the-scenes trickery that can, in some cases, reduce the security of the encryption, but in a predictable -- and acceptable -- way. CipherCloud, for example, allows businesses to leave some fields only partially encrypted to facilitate sorting and matching. In other cases, the cloud security provider imports indices and decrypts the data behind the company's firewall to allow for more advanced processing.

Cloud security-broker PerspecSys uses an on-premise system to act as an application gateway, keeping only necessary data to perform processing on the records.

"We are able to preserve that end user experience, with really strong encryption and tokenization techniques, and still provide the enterprise with really strong security," says Gerry Grealish, vice president of products for PerspecSys.

Grealish criticizes hybrid methods that sacrificed some security. "We did not head down that path because we felt that the trade-off between strong security and making your end user happy was not good," he says.

Researchers continue to work toward a goal of creating encryption systems that can retain their security while being operated on by special functions. Known as homomorphic encryption, such techniques are the Holy Grail of data security, allowing ciphertext to be added and multiplied in a way that returns valid plaintext results, says Voltage's Spies.

"There has been a number of breakthroughs in the past few years that show that it is possible," Spies says, while stressing that usable techniques are still a long way off.

While companies have to choose between reducing security to allow operations in the cloud or keeping some of the operations on-premise to retain control, homomorphic encryption could give them the best of both worlds.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
12/23/2012 | 2:46:31 PM
re: Protecting Data In The Cloud Without Making It Unusable
protecting IP could be the issue that resolves computer systems vulnerability to hacking

content owners may be storing their IP (music, video, books, games, programs etc) in the "Cloud" and then licensing users... by device

to make it work the device will have to be secured

while it is not possible to secure a device that is not in your physical possession it may be possible to detect tampering on a pretty reliable basis

and extension of UEFI could do this particularly if launched from a read-only source .
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.