Cloud storage using encryption gateway with certificate authority identification
Systems and methods to securely send or write data to a cloud storage or server. In one embodiment, a method includes: establishing a connection to a client using a client-side transport protocol; receiving, over the connection, data from the first client; decrypting, using a client session key, the received data to provide first decrypted data; encrypting the first decrypted data using a stored payload key (that is associated with the client) to provide first encrypted data; encrypting, using a cloud session key, the first encrypted data using a remote-side transport protocol to provide second encrypted data; and sending the second encrypted data to the cloud storage or server.
1. A method for securely transmitting data between a client and a cloud storage or server through a gateway, the method comprising:
receiving, by the gateway, first data from the client, the first data including an unencrypted portion and an encrypted portion;
decrypting, by the gateway, the encrypted portion using a first transport protocol to provide first decrypted data;
deriving, by the gateway, a first key stored in the gateway from the unencrypted portion;
encrypting, by the gateway using the first key, the first decrypted data to provide first encrypted data;
encrypting, by the gateway using a second transport protocol, the first encrypted data to provide second encrypted data; and
sending, by the gateway, the second encrypted data to the cloud storage or server.
2. The method of claim 1 , further comprising loading the first key into the gateway and pre-associating the first key with the client.
3. The method of claim 1 , wherein the encrypted portion is encrypted using a symmetric encryption algorithm and the unencrypted portion includes file header information to be used by the gateway to derive the first key.
4. The method of claim 1 , wherein the first or second transport protocol uses Transport Layer Security (TLS), Internet Protocol Security (IPSec), or IEEE MAC Security (MACSEC).
5. The method of claim 1 , further comprising authenticating, by the gateway, the client using one or more authentication factors before receiving the first data from the client.
6. The method of claim 1 , further comprising establishing a secure connection between the gateway and the client for transmitting the first data after the gateway receives a connection request from the client.
7. The method of claim 6 , wherein the establishing includes providing, by the gateway, a certificate to the client verifying an identity of the gateway.
8. The method of claim 6 , wherein the establishing includes receiving, by the gateway, a certificate from the client verifying an identity of the client.
9. The method of claim 6 , further comprising terminating, by the gateway, the secure connection after receiving the first data.
10. A method for securely transmitting data between a client and a cloud storage or server through a gateway, the method comprising:
establishing, by the gateway, a secure connection with the client;
receiving, by the gateway, first data transmitted from the client to the gateway over the secure connection, the first data including an unencrypted portion and an encrypted portion;
terminating, by the gateway, the secure connection after the gateway receives the first data;
decrypting, by the gateway using a first transport encryption protocol, the encrypted portion to provide first decrypted data;
deriving, by the gateway, a first key stored in the gateway from the unencrypted portion;
encrypting, by the gateway using the first key, the first decrypted data to provide first encrypted data;
encrypting, by the gateway using a second transport protocol, the first encrypted data to provide second encrypted data; and
sending, by the gateway, the second encrypted data to the cloud storage or server.
11. The method of claim 10 , further comprising loading the first key into the gateway and pre-associating the first key with the client.
12. The method of claim 11 , wherein the encrypted portion is encrypted using a symmetric encryption algorithm and the unencrypted portion includes file header information to be used by the gateway to derive the first key.
13. The method of claim 10 , further comprising authenticating, by the gateway, the client using one or more authentication factors before receiving the first data from the client.
14. A gateway for securely transmitting data between a client and a cloud storage or server, the gateway comprising:
at least one processor; and
memory containing instructions configured to instruct the at least one processor to:
receive first data from the client, the first data including an unencrypted portion and an encrypted portion;
decrypt the encrypted portion using a first transport protocol to provide first decrypted data;
derive a first key stored in the gateway from the unencrypted portion;
encrypt, using the first key, the first decrypted data to provide first encrypted data;
encrypt, using a second transport protocol, the first encrypted data to provide second encrypted data; and
send the second encrypted data to the cloud storage or server.
15. The gateway of claim 14 , wherein the first key is loaded to the gateway and pre-associated with the client.
16. The gateway of claim 14 , wherein the encrypted portion is encrypted using a symmetric encryption algorithm and the unencrypted portion includes file header information for deriving the first key.
17. The gateway of claim 14 , wherein the instructions are further configured to authenticate the client using one or multiple authentication factors before receiving the first data from the client.
18. The gateway of claim 14 , wherein the instructions are further configured to establish a secure connection between the gateway and the client for transmitting the first data after the gateway receives a connection request from the client.