Authentication Server Data Protection via Key Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems face challenges in minimizing the risk of data compromise due to single points of failure and require efficient key exchange mechanisms, especially in asymmetric and symmetric cryptography.
Innovation Solution
A system utilizing a trusted authentication server that separates payloads from encryption keys and employs a multi-node encryption/decryption protocol with symmetric and asymmetric keys to facilitate secure transmission and access, ensuring the authentication server does not have access to either the payload or the keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric cryptography is used to encrypt and decrypt data, then data security is improved, but resource consumption increases
Solution Approach 1:
The system segments the cryptographic operations by separating symmetric encryption (for bulk data) from asymmetric encryption (for key exchange only). This division allows the resource-intensive asymmetric cryptography to be used minimally while maintaining security, thus resolving the contradiction between data security and resource consumption.
Solution Approach 2:
The patent introduces symmetric keys as an intermediary mechanism. Instead of using asymmetric cryptography directly for all encryption operations, symmetric keys mediate the process by handling the actual data encryption efficiently, while asymmetric cryptography is only used for secure key exchange, thereby reducing overall resource consumption.
2Productivity
If symmetric cryptography is used to encrypt and decrypt data, then processing speed is improved, but key exchange difficulty increases
Solution Approach 1:
The patent uses asymmetric cryptography as an intermediary to solve the key exchange problem. The sender uses the recipient's public key (asymmetric) to encrypt the symmetric key, enabling secure key exchange over insecure channels. This allows symmetric cryptography to be used for fast processing while eliminating key exchange difficulties.
Solution Approach 2:
The system performs preliminary key exchange using asymmetric cryptography before the main data transmission. The symmetric key is established in advance through secure asymmetric encryption, allowing subsequent symmetric encryption operations to proceed at high speed without repeated key exchange complexities.
3Ease of operation
If the authentication server stores encryption keys, then authentication capability is improved, but security risk increases
Solution Approach 1:
The patent extracts the encryption keys from the authentication server's storage. Instead of storing keys on the server, the system uses the server only for authentication verification. The actual encryption keys remain exclusively in the recipient's possession, eliminating the security risk of centralized key storage while maintaining authentication capability.
Solution Approach 2:
The authentication server acts as an intermediary that verifies authentication without possessing the encryption keys. It mediates the authentication process by checking credentials and granting access permissions, while the actual decryption keys remain separate and secure with the recipient, thus maintaining authentication capability without centralizing key storage.
Data Source
AI summary
A method of an authentication server may include receiving, from a recipient computer system, recipient metadata comprising recipient information from the recipient computing system and a recipient network address. Access to the encrypted payload is authenticated by the recipient computer system using the recipient metadata. A response is sent to the recipient computer system after authenticating the recipient computer system. The recipient computer system decrypts the encrypted payload to access the payload in response to receiving the response.