Asymmetric Encryption Key Rotation for Sensitive Data Disclosure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for divulging sensitive information to authorized entities while minimizing the risk of theft by unauthorized entities are inadequate, as they often require unencrypted data to be temporarily stored in memory, making it vulnerable to capture by malware or unauthorized access.
Innovation Solution
A system that decrypts sensitive information using a private key and re-encrypts it with a public key corresponding to the authorized entity, sending the re-encrypted data through a different communication channel, thereby reducing the risk of unauthorized access by requiring access to both the authorized entity's account and their email.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive information is temporarily stored in unencrypted form in memory for processing, then the information can be accessed and processed by authorized entities, but the information becomes vulnerable to capture by malware or unauthorized access
Solution Approach 1:
The system performs preliminary encryption of sensitive information before it is stored or transmitted. The information is encrypted at the source using asymmetric encryption, so that even if captured during transmission or storage, it remains inaccessible to unauthorized parties. This preliminary protective action eliminates the need to handle unencrypted sensitive data in memory.
Solution Approach 2:
The patent introduces an asymmetric encryption system as an intermediary between the sensitive information and any potential access points. The public key acts as a mediator for encryption, while the private key serves as a controlled mediator for decryption. This intermediary layer ensures that sensitive information never exists in unencrypted form in transit or storage, only appearing in plaintext within the secure memory of the authorized device after decryption.
2Object-affected harmful factors
If sensitive information is encrypted with asymmetric key encryption prior to storing or transmitting, then the risk of unauthorized access is reduced, but the information cannot be accessed by authorized entities without the private key
Solution Approach 1:
The patent segments the encryption keys into two distinct parts: a public key for encryption and a private key for decryption. The public key can be freely distributed to authorized entities for encrypting their data, while the private key remains securely stored in the authorized entity's device for decryption. This segmentation allows both security and accessibility to coexist.
Solution Approach 2:
The system changes the cryptographic parameters dynamically based on the operation being performed. For data protection, asymmetric encryption with public/private key pairs is applied. For authorized access, the corresponding private key is used to decrypt. This parameter change approach allows the same system to provide both strong protection and easy authorized access.
3Device complexity
If the same communication channel is used for both requesting and receiving sensitive information, then the process is simpler, but unauthorized entities can more easily intercept the information
Solution Approach 1:
The patent adds a dimensional separation to the communication process by using different communication channels for different purposes. The request channel and the data transmission channel are separated, so that sensitive information does not traverse the same path as the request. This dimensional separation makes interception more difficult as an attacker would need to compromise multiple independent channels.
Data Source
AI summary
Devices and techniques for controlling disclosure of sensitive information are provided. A request for information may be received through a first communication channel. The request may be provided using an account of a user. First encrypted data, which includes the requested information and has been encrypted with a first asymmetric encryption key, may be decrypted. The decrypted information may be re-encrypted with a second asymmetric encryption key different from the first asymmetric encryption key to obtain second encrypted data comprising the information. The second encrypted data may be sent to the user through a second communication channel different from the first communication channel.