This article explains SSProtect data protection and host-specific operating options.
SSProtect was designed to manage and protect sensitive data, maintaining integrity and high availability (:Recover) while protecting against unauthorized access (:Access) and disclosure (:Confidential). Backed by fine-grained, secure auditing (:Assess) and monitoring (Honeypots) enhanced by event analysis (:Respond) and disaster recovery (:xRecovery), this scalable set of unified services reduces data breach impact and operational disruptions without reliance on existing or future IT applications and/ or infrastructure.
Symmetric and Asymmetric Cryptography
Data encryption algorithms utilize keys (among other inputs) to obfuscate content from unauthorized interpretation, implementing data confidentiality. Whereas symmetric cryptography uses a single key for both encryption and decryption, asymmetric cryptography commonly utilizes a public/ private key pair to carry out signing and validation operations. And though effective utilization of the underlying algorithms allows application logic to deliver high levels of protective assurances, key storage, transmission, utilization, and protection present a diverse set of challenges widely perceived to be at the heart of a proper protective solution.
And while there are a relatively small number of well-defined, publicly reviewed and accepted algorithms designed to provide the fundamental building blocks for things like data protection, no two systems are alike since the combination, management, and execution of these primitives generally defines the boundaries for protective posture, ease of end-use, and administrative complexity.
More importantly, the improper use and/ or combination of these algorithms provides attackers with opportunities to violate the most basic priorities of a secure solution.
SSProtect utilizes cryptographic primitives in unique (and patented) ways to combine a high degree of protection aimed at managing today's most aggressive threats with reduced end-user complexity and administrative burden. This article describes some of these facilities with the goal of providing suitable insight to choose the approach best aligned with your needs.
Encryption algorithms come in many forms, some using different operating modes - for example Cipher Block Chaining (CBC), Electronic Codebook (ECB), Galois/Counter Mode (GCM), to name a few (symmetric). Operating mode are designed for specific purposes, and present various tradeoffs - in some cases shortcomings that render practical use ineffective.
Traditional encryption was not specifically designed to combine host-based computing with cloud-based service offerings, and even still encryption alone is not sufficient for complete data protection. SSProtect delivers a platform of patented methods that combine the power, flexibility, and effectiveness of distributed computing together with innovation in cryptographic primitives to maintain business continuity in the face of today's inevitable data breach dynamics.
Generic Composition (as applied to Cryptography, not poetry) is a name given to the act of combining two or more individual cryptographic algorithms to achieve additive results. Though it may seem practical to link encryption, authentication, and/ or integrity protection in a serial fashion, one must take care to avoid violating essential assumptions and requirements lest end results suffer deficiencies not obvious outside the realms of cryptographic experts.
This has proven to be historically significant and problematic, and we've seen standards bodies suffer limitations as a direct result. SSL/ TLS, IPsec, and SSH have, for example, each suffered direct and specific limitations that have since been addressed with adjustments to the way these considerations are managed.
In-Place Encryption and Protection
SSProtect hides management details to simplify use and operation, allowing you to retain focus on your business rather than take on the daunting tasks associated with key management and/ or integrated cryptographic operation. Our data security methods deliver application-independence and continuous protection while maintaining protective control over content while it's in-use. The foundation for these integrated services is referred to as In-Place Encryption and Protection.
Encryption alone is insufficient for protecting data, and though we often refer to this mechanism using the shorter form, In-Place Encryption, we are always making reference to the combined set of security services that together increase data protection while removing end-use complexity associated with traditional endpoint encryption software.
SSProtect encrypts end-user content using the Advanced Encryption Standard (AES), and by default uses a 128-bit key. Use the Licensing and Components interface to enable AES-256, when required.
Note however that AES-256 has been observed to take as much as 40% more overhead than AES-128, though with SSProtect it can be as little as 15% (depending on your environment and hardware). Research indicates that certain side-channel attacks on AES-256 can reduce its' effectiveness to that of AES-128 or even less. The theory behind this is interesting to some, boring to others, important for all, yet not particularly significant in most cases. Because of the way SSProtect manages cryptographic offloading (see below), AES-256 need not be used except when required by standards.
Cipher Block Chaining
SSProtect uses AES in a modified cipher block chaining (CBC) mode. AES-CBC breaks source data into blocks and encrypts (or decrypts) each in succession. With AES-CBC, the output from one block operation provides an input for the next block operation, chaining them together. This creates a contiguous encrypted (or decrypted) result. AES-CBC uses a single Key and a unique Initialization Vector to encrypt and decrypt data.
SSProtect offloads aspects of cryptographic operation to remote (cloud) servers. Servers operate in closely monitored and strictly maintained environments less exposed to intrusion than most business computing resources. Cryptographic offloading increases key management facilities and thus protection, else keys would be limited to host computing equipment where encrypted content is stored. In such a case, even if host keys are, "protected", attacker host compromise exposes host keys, providing access to, "protected" content.
Offloading not only isolates and protects sensitive decryption keys, but also serves as a central point of control in support of precise, accurate auditing, secure data sharing, secure data backup/ restore, disaster recovery, and disclosure analysis - features exposed by modular and scalable/ optional system components.
Host Hardware Isolation
Compare this approach to one that utilizes host-embedded hardware isolation, available with a TPM or host processor-embedded secure enclaves. First, these hardware facilities lack the resources for distributed scope. Second, they suffer limited protection against host impersonation threats, a far more prevalent reality than publicly disclosed.
By combining and offloading encryption facilities to remote, independently managed systems, SSProtect delivers a greater protective posture than otherwise attainable using a single host - and without direct access to plaintext materials. This mirrors the claimed benefits of a Zero Trust Architecture, which despite its' merits, is in our experience seldom properly realized.
Cloud Offloading Communcations Protocol
SSProtect utilizes a custom secure data communications protocol between the host operating environment and cloud services. By designing offloading transactions directly into the protocol's foundation, from the ground up, our team has been able to minimize latency and maximize reliability while adhering to the most stringent data security requirements possible. This reduces ongoing risk from 0-day exploits in open source software, programmatic technology frameworks, and protocol standards to deliver a strong security posture without relying on operating system patches and security updates for sustainability.
This is in fact the philosophy brought to bear in all applied cryptographic operations, though it's critical to recognize that the fundamental building blocks utilize known, proven and accepted algorithms, transforms, and techniques. Though our team has access to those who can and have delivered encryption algorithms that are the standards of today, there is no compelling reason to deviate from best practices or use, "custom" crypto. It's worth noting, however, that a proper system should deliver alternatives on the chance that new discoveries reduce the effectiveness of a one-dimensional approach.
Our protocol adheres to best practices to (for example) provide data confidentiality, integrity protection, (anti-) replay protection, so-called non-repudiation, and of course perfect forward secrecy while also implementing mitigating facilities for Denial of Service attacks and other ongoing threats.
For details, contact Support and we'll be happy to work with you to show how and why we are able to maintain infrastructure compatibility with a high degree of certainty, reliability, and performance.
To properly utilize remote servers (in the cloud), the software first encrypts source material at the host while storing the host encryption key locally. This helps to isolate cloud service layers from plaintext access. Though there are many cloud encryption solutions on the market today, many do not encrypt data before transporting it to the cloud. SSL/TLS alone does not address this issue, since the receiving end acquires content in the same form supplied at the host. As such, and in that case, content in plaintext form - even briefly - becomes a point of opportunity for malicious insiders and attackers. This is a prevalent point of weakness addressed by first encrypting host content, then uploading.
As noted before, storing decryption keys with encrypted content offers little practical protection. SSProtect uploads the encrypted file to remote servers (in the cloud) then performs another encryption operation using an independent server key. This key is kept on the remote server (in the cloud) while the double-encrypted result is returned for storage on the host.
When data is later accessed, :Access manages the request using 2-factor authentication before performing partial cloud decryption then finishing at the host. This inhibits impersonation (i.e. an attacker pretending to be an authorized user with use of a stolen password, for example).
NOTE: Hybrid Conversion is now the preferred method for :Recover operation, though both Modes are available and supported. See below for more.
Ineffectiveness of Login Gates
Though 2FA is offered by some providers, SSProtect applies 2FA to every privileged request rather than unlocking a sensitive archive of data with a single 2FA-enabled Login operation. This latter approach only serves to open an archive for long-term access, which exposes content to attackers lying in wait. For a real-world example, with an attacker statement on the futility of what we call a 2FA Login Gate, see our review of The Hacking Team breach.
SSProtect provides an alternative mode of operation - Optimized Offloading - to increase performance when :Recover is not being used. This approach utilizes a modified Cipher Block Chaining mode of AES to encrypt blocks on the host while at the same time partially offloading block encryption to remote servers. The first block is always double server(cloud)-encrypted, and from there individual blocks can also be offloaded to the cloud to provide a random distribution of host/ server participation. This minimizes the amount of data transfer and also reduces the need for complete redundant encryption while retaining the advantage of server-isolated keys (with respect to the host where encrypted content is stored).
True Plaintext Isolation
Why not upload the file and encrypt once? We do not permit service provider access to your plaintext material, since no amount of procedural control or sandboxing will stop a malicious insider at all times. The only suitable path is to make sure your plaintext data isn't available in the cloud, which remains a fundamental and ongoing requirement for managed data.
Starting with v7.2, Hybrid Conversion replaces Double Encryption as the preferred Operating Mode. Hybrid combines aspects of Optimized Offloading and Double Conversion Modes to increase the performance over Double Encryption while also providing greater MSP isolation. Isolation is specifically improved even when you choose to add MSP Accounts as Third Party Trusts. For details, contact Support.
:Recover Archive Content with Double and Hybrid Operating Modes
When using Hybrid Conversion, Owners using :Recover cannot Restore data instances created by Third Party Trusts - modified content must be provided to the Owner who can then access data directly.
This Restore limitation is not present when using Double Conversion: You can directly Restore shared instances created by peers and Third Party Trusts.
:xRecovery Archive content, however, does not include Third Party Trust instances - whether using Double or Hybrid Conversion.
For more insight, refer to the Re-Protection Policies section of the article, Protected Data Sharing, and also details in the article, Using Shared Data. Send questions to Support, who can also authorize use of Double Conversion for your Account or Organization.
SSProtect utilizes encryption as part of its' protective proposition. Because protected content retains flexible use, it will be exposed to malice and corruption. AES Decryption, alone, can detect some data modification, but not all. As such, with ordinary AES encryption/ decryption, it's quite possible to open a corrupted file and never know it. In fact, corruption in these terms is not always observable.
SSProtect integrates HMAC-SHA512 into the core mechanism used for data protection, providing assurances that data integrity has been retained. This is a configurable setting that can be adjusted in the License and Components interface. When enabled, if you attempt to access a protected file that has been corrupted or modified, the operation fails, protecting you against malice and/ or corruption.
Overriding Integrity Protection for Troubleshooting
You can override Integrity Protection failures to access plaintext content by enabling the override in the Account Configuration dialog (Individual Accounts) or Administer Users display (Organization Accounts). Override only applies when performing a Release Protection operation, and always requires that you choose whether to proceed or abort (by responding to a prompt so you have absolute insight that corruption has been found).
Integrity Override changes for Individual Accounts are temporary, valid only for the duration of a single SSProtect Login Session. Overrides for Organization Users are configured for each specific Account, however remain in effect until disabled.
NOTE: Use this feature with caution, and never continue forward with content accessed after an Integrity Check failure, since it will be corrupted even if not observable. Contact a DefiniSec Representative for details.
Performance and Flexibility
Optimized Offloading is by far the better performing mechanism. You can in fact configure the system to dynamically switch from Double/ Hybrid Encryption to Optimized Offloading when target files transcend a certain size threshold. Configure these options using the Account Configuration display accessible from the notification icon's context menu. There you can set the threshold and choose to automatically switch from Double/ Hybrid Encryption to Optimized Offloading, deny the dynamic switch altogether, or ask to be prompted to decide on the fly. When this mechanism is disabled, you can also set a high-limit threshold for encryption operation, failing when target file sizes exceed the limit you configure. This can help when managing :Recover Quota limits.
IMPORTANT: Don't forget that Optimized Offloading will NOT keep a backup copy of your protected content, thus you will not be able to utilize :Recover to retrieve any file instance you choose to protect with Optimized Offloading. This may be OK for certain circumstances, which is when the Prompt option for dynamic switching may be more suitable.
When sharing content between two Accounts, Conversion Modes may not be the same. Shared, managed re-encryption utilizes the policies set forth by the data owner when content was last protected. At present, reprotected content retains its' association with the owner's :Recover Archive and thus Quota. If a hard Quota Limit is exceeded, reprotection will fallback to Optimized Offloading and send a note to the Owner that his/ her Quota Limit has been reached.
At the present time, when using :Recover and Hybrid Conversion, shared instance content is not available for owner Restore. This is not the case when using Double Conversion. Note however that, with Hybrid Conversion, the original owner only needs to execute a managed open/ close operation at which point the modified data will be server-retained and available for Restoration.
These states can be enumerated using the Managed Files/ Restore display: Versionlist items will have a non-zero size when they are stored in the server (cloud) Archive. All three panes - the Hostlist, Versionlist, and Archivelist - use context-sensitive Restore/ Replicate buttons based on the target selection, indicating items available for Restoration.
Effective use of encryption together with access control can provide a suitable barrier against challenging attack dynamics. Isolated encryption is not enough, and when cryptographic offloading is introduced to an already effective integrated solution, capability rises to levels suitable for the most advanced threats known today. SSProtect offers these capabilities with options - Double and Hybrid Conversion for those that want the convenience of backup and restore, Optimized Offloading for those who have more stringent performance requirements, and the ability to switch between the two on-demand while incorporating Data Integrity validation and maintaining continuous protection, independent of an item's managing container.
This unique, system-integrated approach to data protection and management includes further IT and Security focused tools for Disaster Recovery and Incident Response, which as a whole represents a first for the industry.
Intellectual Property Disclosure
In-Place Encryption and Protection, cryptographic offloading techniques, and other critical aspects of SSProtect, KODiAC, and its' components are protected by U.S. Patent No. 10462114: System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading.
You can search this site for more information on various topics, or use this link to submit a specific request. You can also send email directly to firstname.lastname@example.org, and our staff will respond to your needs as soon as possible.
In the meantime, don't forget to check out our primary website and Insights columns for information on current trends, security topics, and how our technologies relate.
This article was updated w/ v9.7.0 of the :Foundation Client