Customer call logging data privacy in cloud infrastructure
Systems and methods are provided for encrypting data at a customer for storage at a hosted service provider. In addition to the data being encrypted by the client, the secret encryption key used to encrypt the data is also encrypted. Both the encrypted data and the encrypted secret encryption key are transmitted to the service provider who may further encrypt the data with another encryption key and who stores the further encrypted data, the encrypted secret encryption key and the another encryption key.
1. A system for secure storage of customer data by a remote service provider equipment (SPE), said system comprising:
a processor based customer premise equipment (CPE); said CPE having an application programming interface (API) and a key manager;
said CPE configured to generate a secret encryption key;
said key manager is configured to provide a master encryption key to said API for encrypting said secret encryption key;
said CPE is also configured to generate a data, and encrypt said data with said secret encryption key, to encrypt said secret encryption key with said master encryption key and to transmit said encrypted data and said encrypted secret encryption key for receipt and storage by said service provider.
2. The system according to claim 1 wherein said data includes a voice recording.
3. The system according to claim 1 further comprising a download tool configured to recall said data from said service provider and decrypt said recalled data for playback.
4. The system according to claim 3 wherein said download tool is further configured to receive said secret encryption key and decrypt said secret encryption key with said master key.
5. The system according to claim 1 wherein said CPE is further configured to receive a service provider public encryption key (PK) and to encrypt said encrypted data and said encrypted secret encryption key with said PK prior to said transmission of said encrypted data and said encrypted secret encryption key.
6. A method for storing customer data at a remote service provider, said method comprising:
a customer accessing via a processor based device a service provided by said service provider;
said customer generating data as a result of said access;
said processor based device generating a secret encryption key;
said processor based device encrypting said data with said secret encryption key and transmitting said encrypted data for receipt by said service provider;
said processor based device encrypting said secret encryption key with a master encryption key; and,
said processor based device transmitting said encrypted secret encryption key for receipt by said service provider.
7. The method according to claim 6 wherein said CPE generates said master encryption key.
8. The method according to claim 6 wherein said CPE receives said master key from the service provider.
9. The method according to claim 6 wherein said CPE receives said master key from a third party.
10. The method according to claim 6 further comprising said SPE receiving said encrypted data and said encrypted secret encryption key and further encrypting said encrypted data with a tenant encryption key; and,
said service provider storing said further encrypted data and said tenant key in a storage.
11. The method according to claim 10 further including said SPE further encrypting said encrypted secret encryption key and storing said encrypted secret encryption key in another storage which is separate from said storage.
12. The method according to claim 10 further including said SPE further encrypting said encrypted secret encryption key and transmitting said further encrypted secret encryption key for receipt by said CPE.
13. The method according to claim 6 further comprising said SPE receiving said encrypted data and said encrypted secret encryption key, further encrypting said encrypted secret encryption key with a tenant encryption key and further encrypting said encrypted data with a CPE public key; and,
said SPE storing said further encrypted data and said further encrypted secret encryption key in physically separate storage devices.
14. A method for storing at a service provider customer data, said method comprising:
said service provider receiving an encrypted secret encryption key and an encrypted data from a processor based customer equipment running an application provided by said service provider, said data being encrypted with said secret encryption key;
said service provider further encrypting said encrypted data and storing said further encrypted data in a storage device; and,
said service provider further encrypting said encrypted secret encryption key.
15. The method according to claim 14 wherein said further encryption of said data is with a customer provider public encryption key and said further encryption of said encrypted secret encryption key is with a tenant encryption key.
16. The method according to claim 14 wherein said further encryption of said data is with a tenant encryption key and said further encryption of said encrypted secret encryption key is with a customer provided public encryption key.
17. The method according to claim 14 further including said service provider storing said further encrypted secret encryption key in a storage which is separate from said storage containing said further encrypted data.
18. The method according to claim 16 further including said service provider transmitting said further encrypted secret encryption key for receipt by said customer.
19. The method according to claim 16 wherein said data is a voice recording.
20. The method according to claim 15 wherein said tenant encryption key is stored separate from said further encrypted secret encryption key.