Access Control Mechanism for Cryptographic Key Store
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face inefficiencies due to resource-intensive data copying for cryptographic processing and limitations in memory space for complex security policies, leading to inflexibility and difficulty in modifying or expanding security policies.
Innovation Solution
A computing device with a key store and an access control mechanism that allows direct access to keys after authorization, enabling applications to communicate directly with the key store and manage cryptographic operations without the need for data copying, with security policies implemented in user space for flexibility and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is copied to and from the dedicated cryptography server for cryptographic processing, then access control is achieved, but resource consumption increases and efficiency decreases
Solution Approach 1:
The patent extracts the security policy storage and access control logic from the cryptography server to a dedicated access control list (ACL) stored in the key store. This separation allows the cryptography server to focus on cryptographic operations while the ACL handles access control, eliminating the need for data copying and improving processing efficiency.
Solution Approach 2:
The patent introduces an access control mechanism that acts as an intermediary between applications and the key store. This mechanism uses an access control list to mediate access requests, allowing direct access to keys when authorized without requiring data copying through the cryptography server.
2Reliability
If security policies are stored in cryptographic hardware, then access control is enforced, but memory space is insufficient for complex policies and modification becomes difficult
Solution Approach 1:
The patent moves security policies from the constrained hardware dimension to the software dimension by storing access control lists in the key store and managing policies in user space. This dimensional shift provides abundant storage space for complex policies and enables easy modification and expansion without hardware limitations.
Solution Approach 2:
The patent implements dynamic security policies that can be modified and expanded in user space. The access control mechanism allows policies to be updated, added, or removed without requiring hardware changes, making the system adaptable to changing security requirements.
3Reliability
If applications communicate through the cryptography server for key access, then security is maintained, but resource intensity and processing overhead increase
Solution Approach 1:
The patent performs preliminary access control checks by storing and evaluating access control lists in the key store before cryptographic operations. This preliminary action determines authorization in advance, allowing direct key access without requiring applications to communicate through the cryptography server, thereby reducing resource consumption.
4Adaptability or versatility
If a dedicated cryptography server is used for access control, then security policies can be managed, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts the access control functionality from the dedicated cryptography server and implements it as a separate access control mechanism using an access control list stored in the key store. This extraction simplifies the system architecture by removing the need for a dedicated cryptography server while maintaining security policy management capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device which includes an access control mechanism which is used to control access to keys which are used in cryptographic processes. Any application wishing to gain access to a key must first obtain authorisation from the access control mechanism. Authorised applications may access keys directly, without having to pass data through the access control mechanism.