Hierarchical Access Level Key Management for Secure Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure platforms face challenges in efficiently managing access to application data on computing devices, particularly in dynamically adjusting access levels and ensuring secure encryption and decryption processes.
Innovation Solution
A method is introduced that involves storing data with access levels, where each access level is associated with a combination of credentials and an access level key. The method determines the appropriate access level based on available credentials, decrypts the access level key, and uses it to provide access to encrypted application data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple access levels with different credential combinations are implemented, then access control flexibility and security are improved, but system complexity increases
Solution Approach 1:
The patent segments access control into multiple discrete access levels (first access level, second access level, etc.), each with its own credential requirements and permissions. This segmentation allows the system to manage complex access control by breaking it down into manageable, hierarchical levels rather than treating all access control as a single monolithic system.
Solution Approach 2:
The patent implements dynamic access level assignment where the system can determine and switch between different access levels based on available credentials. The access level determination is not static but dynamically adjusted based on which credentials are present, allowing flexible adaptation to different user contexts and security requirements.
2Reliability
If access level keys are encrypted with credential combinations, then security is improved, but decryption performance and access speed deteriorate
Solution Approach 1:
The patent performs preliminary action by pre-determining the appropriate access level and preparing the necessary decryption keys before actual data access is required. The system evaluates available credentials and identifies the correct access level in advance, so that when data access is needed, the decryption process can proceed immediately without delay.
Solution Approach 2:
The patent introduces an intermediary access level determination mechanism that sits between the encrypted data and the decryption process. This intermediary layer evaluates credentials, determines the appropriate access level, and retrieves or generates the corresponding decryption key, thereby mediating between security requirements and access performance.
3Adaptability or versatility
If hierarchical access levels with subordinate key relationships are implemented, then fine-grained access control is improved, but key management complexity increases
Solution Approach 1:
The patent implements a nested key hierarchy where higher-level access keys can decrypt lower-level keys (e.g., second access level key decrypts first access level key). This nesting structure allows fine-grained access control where users with higher clearance can access all data levels, while maintaining organized, hierarchical key management that is more manageable than flat, non-hierarchical approaches.
Data Source
AI summary
A method, system and computer-readable storage medium for controlling access to application data associated with an application configured on a computing device. The method comprises: storing data comprising, for each of a plurality of access levels associated with the application, first data indicative of a combination of one or more credentials associated with the respective access level and an access level key corresponding to the respective access level, the access level key being encrypted by the combination of one or more credentials associated with the respective access level; determining, based on the first data, an access level in the plurality of access levels corresponding to a combination of one or more credentials available to the application; decrypting the access level key in the stored data corresponding to the determined access level using the combination of one or more credentials available to the application; and providing access to encrypted application data associated with the application and corresponding to the determined access level using, at least in part, the decrypted access level key corresponding to the determined access level.