Protection scheme for remotely-stored data

#The present disclosure relates to data security, and more particularly, to a scheme for protecting the security of data stored on a remote resource such as a cloud storage system.

#Data management in electronic devices (e.g., computing devices) is evolving towards a more distributed architecture. For example, while data was traditionally stored in persistent memory local to device, data may now be remotely-stored in a remote resource. An example remote resource may be a cloud-based computing solution comprising at least one computing device (e.g., a server) accessible via a wide-area network (WAN) such as the Internet. There are a variety of benefits that may be realized when using remotely-stored data architectures. For example, data may be accessible not only to the device that generated the data, but also to other devices (e.g., mobile computing devices, mobile communication devices, etc.) that may benefit from being able to access the data regardless of location. The other devices may access data on the remote resource via wired or wireless connections to the Internet. Moreover, remotely-stored data may be much more tolerant of catastrophic events such as fires, weather emergencies, power outages, etc., since cloud-based resources are often built to account for such events with more substantial event protection, backup resources, etc.

#While the benefits of remotely-stored data may be apparent, there are also some risks. For example, users storing a variety of data (e.g., that may comprise confidential information) in a single location presents an enticing target for hackers that may have malicious intentions. Encrypting the data prior to storage on the remote resource may help to prevent hackers from gaining access, however, the tools used to perform the encryption must also be protected. For example, when a user is responsible for encrypting data prior to storage on a remote resource, rootkits and other high-privilege attacks may be able to gain access to encryption keys stored on the device of the user. Moving responsibility for data encryption to the remote resource (e.g., cloud-based storage provider) does not alleviate this problem as the same type of attack may be used to access the encryption keys stored in the remote resources (e.g., on a server).

#Features and advantages of various embodiments of the claimed subject matter will become apparent as the following Detailed Description proceeds, and upon reference to the Drawings, wherein like numerals designate like parts, and in which:

#FIG. 1 illustrates an example configuration for a protection scheme for remotely-stored data in accordance with at least one embodiment of the present disclosure;

#FIG. 2 illustrates an example configuration for a device in accordance with at least one embodiment of the present disclosure;

#Although the following Detailed Description will proceed with reference being made to illustrative embodiments, many alternatives, modifications and variations thereof will be apparent to those skilled in the art.

#The present disclosure is directed to a protection scheme for remotely-stored data. An example system may comprise at least one device including at least one virtual machine. The at least one virtual machine may be to process data, which may include the storage of data on a remote resource. In this regard, the at least one device may also include a trusted execution environment in which an encryption service may execute. The encryption service may be to encrypt or decrypt data received from the at least one virtual machine. In one embodiment, the at least one virtual machine may include an encryption agent. The encryption agent may be to provide data to the encryption service for encryption or decryption. For example, the encryption agent may register with the encryption service, at which time an encryption key corresponding to the at least one virtual machine may be generated. After verifying that the encryption agent is already registered, the encryption service may utilize the encryption key corresponding to the at least one virtual machine to encrypt or decrypt the data received from the encryption agent, and then return the encrypted or decrypted data to the encryption agent.

#In one embodiment, at least one device may comprise, for example, at least one virtual machine and a trusted execution environment. The at least one virtual machine may be to process data in the at least one device. The trusted execution environment may include at least an encryption service to encrypt or decrypt data provided to the encryption service from the at least one virtual machine.