Class-Based Encryption for Cloud Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing scenarios, ensuring data security and enabling efficient data processing for large volumes of data, known as 'big data,' is challenging due to the need for either compromising on data security or functionality, as complete encryption hinders distributed processing and access control.
Innovation Solution
Implementing class-based encryption, where data is encrypted with class-dependent public cryptographic keys, allowing restricted access and decryption by authorized service providers, while maintaining data owner control through a key management system that manages class-independent asymmetric master keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is fully encrypted to ensure security, then data security is improved, but distributed processing functionality deteriorates
Solution Approach 1:
The patent segments the encryption approach by introducing multiple encryption keys corresponding to different data classes. Instead of a single encryption scheme, the system divides data into classes (e.g., sensitive, semi-sensitive, public) and applies appropriate encryption levels to each class, enabling selective accessibility for distributed processing while maintaining security where needed.
Solution Approach 2:
The patent implements local quality by applying different encryption strengths and access controls to different portions of data based on their sensitivity classification. Critical data fields within records can have different encryption levels, allowing service providers to access only the portions of data they need for processing while other portions remain encrypted.
2Adaptability or versatility
If data is left unencrypted to enable processing, then processing functionality is improved, but data security deteriorates
Solution Approach 1:
The patent introduces an intermediary key management system that mediates between data security requirements and processing functionality. The key management system acts as a trusted intermediary that controls access to decryption keys, allowing service providers to process data only when authorized, thus enabling functionality while maintaining security through controlled key distribution.
Solution Approach 2:
The patent changes the parameter of encryption accessibility by dynamically controlling which decryption keys are made available to service providers. Based on authorization levels and data classification, the system adjusts the accessibility parameters of encrypted data, allowing processing of certain data classes while maintaining encryption for others.
3Adaptability or versatility
If class-based encryption is implemented to enable selective access, then access control flexibility is improved, but system complexity increases
Solution Approach 1:
The patent implements universality by designing a key management system that handles multiple functions through a unified framework. The same key management infrastructure supports data classification, key generation, key distribution, access control, and audit logging, reducing overall system complexity despite the multi-class encryption approach.
Solution Approach 2:
The patent applies dynamics by making the key management system adaptable and configurable. The system can dynamically adjust encryption classes, update key distribution policies, and modify access controls based on changing requirements, allowing the complexity to be managed through flexible configuration rather than hard-coded structures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for processing a data set (108) by a user computer system (102). The method comprises assigning the data set (108) to a first class (408) of a classification scheme. The data set (108) is provided with metadata (106), wherein the metadata (106) comprises a first class ID of a plurality of class IDs, which identifies the first class (408) of the classification scheme to which the data set (108) is assigned. At least the data set (108) or the metadata (106) is encrypted using class-based encryption with a class-dependent first public cryptographic key (110), which is calculated using the class ID and a class-independent public cryptographic master key (110).