METHOD FOR COMBINED DATA ENCRYPTION IN CLOUD ENVIRONMENTS

Abstract

The article is devoted to the development of a cryptographic data protection method for corporate cloud environments based on the Zero Trust concept, taking into account the requirements for performance, scalability, and predictable latency. The introduction substantiates the relevance of the topic in the context of the transition of corporate systems to cloud services, the growth of cyber threats, and the need to combine cryptographic strength with practical operational constraints. The section reviewing recent studies examines the regulatory and scientific foundation of the research, covering both international and national information security standards, Zero Trust approaches, access control models, and encryption methods. On this basis, the paper formulates the problem of the absence of an integrated method that would simultaneously consider the threat model, separation of trust levels, key management, and time constraints typical of high-load systems.

The research part shows that homomorphic encryption, despite its advantages for processing encrypted data, cannot be used as the basic storage protection mechanism because of substantial computational overhead. Its use is justified only as a separate service layer for specialized scenarios. The main attention is focused on the architectural principles of the method: distrust of the provider infrastructure, client-side execution of critical cryptographic operations, and a formalized cryptographic context.

The paper defines protection profiles for object, file, and network block storage. For object and file access, authenticated symmetric encryption with additional authenticated data is proposed. For network block storage, the method specifies sector-level authenticated encryption and XTS-AES only in combination with separate cryptographic authentication. A structured approach to deterministic key derivation, key rotation, and key isolation within a trusted key management domain is also formulated. The conclusions summarize that the proposed method can be used for the design or modernization of corporate information protection systems.