Hybrid Encryption and Intelligent Pattern-Matching Architecture for Cloud Security

The escalating frequency of data breaches in cloud storage environments has exposed the inadequacies of monolithic security models, where static authentication and opaque server-side encryption fail to protect against credential compromise and insider threats. This work presents Zenith, a secure cloud management platform that unifies multi-layered defense mechanisms across three critical domains: cryptographic access control, hybrid dual-encryption architecture, and automated threat detection. The Security Management Service implements RFC 6238-compliant Time-based One-Time Password (TOTP) authentication using HMAC-SHA1 verification with a flexible 90-second drift tolerance window, achieving verification speeds of 10–20ms while mitigating replay attacks. The encryption framework introduces a hybrid model offering Server-Side Encryption (SSE) using AWS S3 native AES-256 for general performance, and a zero-knowledge Client-Side Encryption (CSE) architecture that derives 256-bit keys using PBKDF2-HMAC-SHA256 with 100,000 iterations and a unique 16-byte salt, ensuring the platform possesses no decryption capability for sensitive data. To proactively prevent data leakage, an Automated Sensitive Data Detection pipeline utilizes regex-based pattern matching to identify Personally Identifiable Information (PII), credit card sequences (13−16 digits), and private IP ranges in real time, automatically triggering mandatory encryption workflows for flagged files. Data durability and disaster recovery are secured through AWS Cross-Region Replication (CRR) spanning approximately 2,800 miles (N. Virginia to Oregon), achieving 99.999999999% (eleven nines) data durability with eventual consistency typically achieved within 15 minutes.Comprehensive session auditing through MongoDB collects the device fingerprint and geolocation information, giving fine-grained visibility to access patterns. Experimental validation looks at that the platform balances rigorous security with operational efficiency, maintaining a client-side encryption overhead of only 200–300ms per megabyte, effectively establishing a compliant, resilient, and transparent foundation for secure cloud data management.