How to lock down data in use -- and in the cloud

Security best practices traditionally call for encrypting data in transit, as it moves from one storage locale to another, and data at rest, when it resides in an organization’s storage systems.

The advent of cloud computing, however, has created the need for yet another stage of security: data “in-use,” as when a third-party cloud provider maintains it.

The Cloud Security Alliance recommends securing data when it exists in this in-use state. In its 2012 implementation guidance, CSA recommended “controls should be applied throughout the entire lifecycle (in transit, at rest and in use) to allow the customer to maintain control over the data while the [cloud service provider] hosts and processes it.”

Securing data in use, however, presents encryption challenges. For one thing, data typically needs to be decrypted in order for users or work with it.

“Traditionally, if cloud-hosted data is encrypted using block- or file-level encryption, basic server-side operations such as indexing, searching and sorting records are impossible,” according to a whitepaper from Vaultive Inc., a cloud encryption company. “Once ciphertext is incorporated into a SaaS application, some of the features of the service are no longer operational since processes like search, sort and index cannot function against an encrypted ‘blob.’”

A number of companies are aiming to close this key security gap: data being processed in the cloud. And the need for making encrypted data usable in the cloud has generated solutions from companies ranging from startups to industry heavyweights.

In December, IBM said its in-house inventors received a patent for “fully homomorphic encryption,” a technique that the company said lets people “interact with encrypted data in ways previously considered impossible.” The company said its encryption could potentially enable unrestricted analysis of encrypted information.

The startup side includes the New York-based Vaultive and PrivateCore Inc., a Palo Alto, Calif.-based company.

Vaultive’s encryption in use technology focuses on the software-as-a-service cloud delivery model. More than 40 SaaS applications have been tested on Vaultive’s cloud control platform, the company noted. Vaultive does a lot of business with Microsoft’s cloud, citing Office 365, Yammer, SharePoint and Dynamics. But Vaultive supports non-Microsoft applications as well, said Elad Yoran, Vaultive’s chairman and chief executive officer.

Vaultive’s cloud control platform operates as an encryption proxy server. Yoran said this gateway is typically deployed in a customer’s DMZ, between the internal network and the cloud service provider. The gateway may also be hosted by a trusted third party. Data on the way to the cloud service is encrypted as it passes through the gateway and only decrypted when it comes back through the gateway to the customer. In the Vaultive approach, keys are created at the gateway and remain with the customer as opposed to a cloud service provider.

Vaultive recently partnered with immixGroup, which is taking Vaultive through the General Services Administration schedule approval process. The company is also working with Microsoft, teaming on federal bids and placing its technology in Microsoft’s Washington, D.C., area demonstration centers. In addition, Vaultive is preparing a full FIPS 140-2 assessment, according to the company. FIPS 140-2 is the National Institute of Standards and Technology standard for validating cryptographic modules.

“We are now gearing up to go after the federal market and, by extension, other government organizations,” Yoran said. “We are getting the necessary certifications and credentials in these markets.”

Vaultive’ technology has been included on a large Microsoft bid and on a smaller RFP response, according to the firm. And while immixGroup works on getting Vaultive on the GSA schedule, it will be able to represent Vaultive on other contract vehicles.

Meanwhile, PrivateCore last month announced general availability of its vCage software, which uses memory encryption to protect data in use in the cloud. Todd Thiemann, vice president of marketing at PrivateCore, said the company is interested in the public sector and plans to partner with other companies to purse that market.

PrivateCore focuses on infrastructure-as-a-service offerings and typically operates on a bare metal machine, according to Thiemann. The company’s vCage software targets enterprises that are building clouds around the OpenStack open source cloud computing platform. But the technology may also be applied to any x86 Linux environment, Thiemann said.

The vCage solution includes vCage Manager, which validates the security of OpenStack servers. The vCage Host includes full memory encryption, which PrivateCore says limits clear text data to the CPU internal cache. Thiemann said the memory encryption piece uses standard AES encryption to protect against incursions such as cold boot attacks. Cold boot attacks foil disk encryption and swipe encryption keys from memory.