1

I am building a web-based software as a service (SaaS) platform for engineering simulations that run on the cloud, and wish to prevent my access to user data by design. The user designs a 3D geometry (I have a simple CAD interface) along some simulation properties, and clicks a button to run the simulation on a cloud instance and get some results.

Everything is hosted on AWS. The flow goes like this:

  1. User logs into the web platform (hosted on AWS Amplify*) using Amazon Cognito
  2. User creates a new project, which creates some files in an S3 bucket (<unique_user_id>/projects/<unique_project_id>/...)
  3. User uploads their project data to S3 and submits their simulation project to run, by calling an API endpoint that triggers a Lambda function, launching an EC2 instance
  4. The (high-performance) EC2 instance downloads the project from S3, runs a bunch of complicated math, and uploads/updates the results to S3 every few seconds as the simulation runs (until it finishes, which takes a few minutes/hours)
  5. As the simulation is running, the user queries S3 every few seconds to update the results and plot them in the browser

*Amplify simply hosts my web page - it's probably an irrelevant detail in the context of security.

Here is a diagram of my cloud architecture:

Block diagram

The question

As my customers would be extremely cautious about their highly-confidential simulation data (and uploading their data to the cloud would raise concerns), is there a reliable way to ensure that not only other customers, but also me and Amazon cannot access their data? This may imply encrypting/decrypting data on the browser before submitting to/after reading from S3. However, in order for the EC2 math engine to run the simulations, it needs to handle the decrypted data, and I need to make sure that Amazon and I cannot access the data in the instance.

Note: in case it matters, from the frontend client-side browser code, to the backend EC2 math engine & AWS architecture, everything will be entirely open source. This implies that users can freely study the flow of their data, which should hopefully provide an additional layer of comfort.

Improve this question
7
  • I'm not sure if there's a way to achieve what you want. As long as you have access to the EC2 machine (which you have) you'll be able to access the data. Also, you'll need access to the encryption key/KMS key so you can decrypt the data stored in S3. You may have a look at aws.amazon.com/ec2/nitro/nitro-enclaves ( i have no experience with that) which perhaps provide more guarantees.
    – Juraj Martinka
    Oct 6 at 4:45
  • Is it possible to not have access to the EC2 machine (either by restricting network access altogether/disabling SSH keys)?
    – Coto TheArcher
    Oct 14 at 5:53
  • You can restrict access to port 22 (there's nothing by default if you don't choose to openit). YOu can also skip generating ssh keypair. You'll loose an important tool to troubleshoot problems with those instances but maybe that's fine with you.
    – Juraj Martinka
    Oct 16 at 3:25
  • @JurajMartinka - Yes, that was my idea. I'll obviously not be able to troubleshoot if something goes wrong (other than informing the user of generic errors in a simplified manner), but that would be the same as shipping a desktop application. Is it accurate (true) to claim that I do not have any possible way of inspecting such data? Couldn't I e.g. create an AMI from the running instance, and launch a new instance from that AMI with an SSH key pair?
    – Coto TheArcher
    Oct 17 at 0:55
  • > Couldn't I e.g. create an AMI from the running instance, and launch a new instance from that AMI with an SSH key pair? Sure, you could do that.
    – Juraj Martinka
    Oct 17 at 4:08

0

Reset to default

You must log in to answer this question.