Layered Backup File Encryption for Multi-Host Identity Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack efficient methods for securing and restoring backup data files, particularly in scenarios where user identities need to be transferred or restored to new devices or applications, often requiring re-entry and re-verification of attributes.
Innovation Solution
A layered key encryption system is employed to secure backup data files, using biometric and contact attribute authentications, ensuring secure access and efficient restoration by leveraging multiple encryption layers, including AES and RSA algorithms, with biometric verification and one-time-passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional single-key encryption is used for backup data files, then the encryption process is simple and fast, but the security level is insufficient and cannot provide multi-host recovery capability
Solution Approach 1:
The patent implements a nested encryption structure where multiple encryption keys are layered within each other. The backup data file is encrypted with a first encryption key, then wrapped with a second encryption key, and further protected by additional keys. This nested arrangement provides enhanced security while maintaining a manageable structure for key management and multi-host recovery operations.
Solution Approach 2:
The encryption system is segmented into multiple independent key layers, each serving a specific security function. The first encryption key handles data file encryption, while the second encryption key provides wrapping protection. This segmentation allows each key to be managed independently and enables selective key recovery for different hosts without compromising the entire security system.
2Reliability
If multiple layers of authentication are implemented, then data security is enhanced, but the restoration process becomes more time-consuming and complex
Solution Approach 1:
The system performs preliminary key generation and wrapping operations during the backup creation phase. Encryption keys are generated and wrapped in advance, and the wrapped keys are stored alongside the encrypted backup data file. This preliminary action ensures that during restoration, the pre-wrapped keys are already available, reducing the time required for key recovery and data decryption without compromising security.
Solution Approach 2:
The patent introduces an intermediary key wrapping mechanism that facilitates efficient key recovery. The second encryption key acts as an intermediary that wraps the first encryption key, creating a chain of trust that can be selectively broken for recovery purposes. This intermediary structure enables faster restoration by providing a controlled pathway for key recovery without requiring complete decryption of all security layers.
3Reliability
If backup data files are secured with multiple encryption keys, then access control is improved, but the ease of operation for legitimate users deteriorates
Solution Approach 1:
The encryption system implements local quality by assigning different encryption keys to different access scenarios and hosts. The first encryption key provides baseline protection for all backup files, while the second encryption key provides additional protection specifically for cross-host recovery. This differentiated approach ensures that legitimate users experience appropriate security measures for their specific access needs without unnecessary complexity.
Solution Approach 2:
The multi-key encryption system is designed to be universal across multiple hosts and devices. The wrapped encryption keys are stored in a manner that enables them to be recovered and applied across different host environments. This multi-functionality allows the same encrypted backup file to be securely accessed and restored on any authorized host without requiring user-specific configuration, maintaining ease of operation while enforcing strong access control.
Data Source
AI summary
Systems and methods are provided for backing up a data file. One example computer-implemented method includes generating an L4 key and, for each contact attribute of the data file, generating an L3 file including the L4 key and an identifier of a user and encrypting the L3 file with an un-masked version of the contact attribute. The method also includes compiling the encrypted L3 file(s) and the masked version(s) of the contact attribute(s) into an L2 file, generating an L2 key, encrypting the L2 file with the L2 key, compiling the encrypted L2 file and L2 key into an L1 file, generating an L1 key, encrypting the L1 file with the L1 key, compiling an L4 file to include identity attributes of the user, encrypting the L4 file with the L4 key, and combining the encrypted L4 file and the encrypted L1 file.