Protecting Data In The Cloud Without Making It Unusable

Encryption in the cloud is about preventing outside hackers and external partners -- even the cloud provider themselves -- from accessing a company's private data. However, companies tend to shy away from scrambling their data because, in the past, making the data unreadable to others also disrupted the business.

With encryption, usability is usually the quality that companies have to sacrifice. Employees either have to use special tools to access the data or lose the ability to perform necessary business operations without downloading and decrypting significant portions of the data set.

"The thinking has been that encryption messes with your data -- you can't do operations on it -- and key management is very hard," says Pravin Kothari, founder and CEO of cloud-security firm CipherCloud.

As security firms start to create technologies to secure data in the cloud, they have addressed businesses' primary concern: Not how much security the technology will provide, but whether it will get in the way. While companies have sought out encryption solutions to increase security, meet compliance obligations, and abide by national data residency requirements, many balked because most encryption experts never really thought about usability, says Terence Spies, chief technology officer of Voltage Security.

"People in the crypto world tend to get obsessed with how many bits of protection, but what became evident is that usability and the ability to work with existing business processes is the major determining factor in how much adoption you are going to get," Spies says.

Take a simple property like the storage allocated for data in a database field. Encryption typically expands a piece of text -- or plaintext -- to a certain block size when it turns it into an encrypted format, or ciphertext. This can be a problem if the cloud application expects a relatively short string -- say, a last name -- to be only a score of characters. Typical encryption could make the string too long to fit in the allocated space.

To fix the problem with fitting ciphertext into limited database fields, companies such as Voltage have designed format-preserving encryption that can turn plaintext of a maximum length into a string of ciphertext with the same number of digits. The transformation sacrifices no security, says Spies.

"You've taken a whole class of applications and made them able to operate without needing to get access to keys that would expose the entire data," he says.

Yet using format-preserving encryption does not solve a number of other problems. Encryption also breaks any sort of ordering, and encrypted numbers cannot be added, subtracted, or multiplied in any meaningful way.

[Encrypting data is one of the most basic -- and most effective -- data security measures we have at our disposal, but when used with relational databases, encryption creates two major problems. See A Look At Encrypted Query Processing.]

To support searching, sorting, and other operations requires the security gateway to perform some behind-the-scenes trickery that can, in some cases, reduce the security of the encryption, but in a predictable -- and acceptable -- way. CipherCloud, for example, allows businesses to leave some fields only partially encrypted to facilitate sorting and matching. In other cases, the cloud security provider imports indices and decrypts the data behind the company's firewall to allow for more advanced processing.

Cloud security-broker PerspecSys uses an on-premise system to act as an application gateway, keeping only necessary data to perform processing on the records.

"We are able to preserve that end user experience, with really strong encryption and tokenization techniques, and still provide the enterprise with really strong security," says Gerry Grealish, vice president of products for PerspecSys.

Grealish criticizes hybrid methods that sacrificed some security. "We did not head down that path because we felt that the trade-off between strong security and making your end user happy was not good," he says.

Researchers continue to work toward a goal of creating encryption systems that can retain their security while being operated on by special functions. Known as homomorphic encryption, such techniques are the Holy Grail of data security, allowing ciphertext to be added and multiplied in a way that returns valid plaintext results, says Voltage's Spies.

"There has been a number of breakthroughs in the past few years that show that it is possible," Spies says, while stressing that usable techniques are still a long way off.

While companies have to choose between reducing security to allow operations in the cloud or keeping some of the operations on-premise to retain control, homomorphic encryption could give them the best of both worlds.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.