Client Device Encryption Key Recalculation for Offline Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in securely accessing encrypted data when the client device is offline, as they rely on a remote server for encryption key management, which introduces complexity and potential security risks, and may suffer from performance issues and centralized attack vulnerabilities.
Innovation Solution
Implementing a method where a client device can recalculate its encryption key in the presence of a communications device, without exchanging sensitive key information, using a centralized revocation mechanism to manage access and reduce the need for remote server authentication and backup, thereby enhancing security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a remote server is used to store and manage encryption keys, then key management and access control are improved, but system complexity and potential security risks increase
Solution Approach 1:
The patent extracts the encryption key from the remote server and stores it locally in the memory of the portable device. The key is obtained through a key agreement protocol between the portable device and terminal device, eliminating the need for the portable device to contact the remote server during data access operations. This reduces system complexity while maintaining secure key management.
Solution Approach 2:
The system segments the key management functions by separating the encryption key storage from the remote server. The portable device maintains its own local copy of the encryption key, while the remote server retains administrative control through the ability to revoke access. This segmentation allows independent operation of the portable device without server contact while preserving centralized control capabilities.
2Reliability
If a remote server is used for encryption key management, then centralized control is improved, but network overhead and performance issues increase
Solution Approach 1:
The encryption key is obtained in advance through a key agreement protocol before actual data access operations. The portable device stores this pre-obtained key locally, eliminating the need for repeated network communications with the remote server during data read/write operations. This preliminary action significantly improves system performance by reducing network overhead.
Solution Approach 2:
The terminal device acts as an intermediary that enables the portable device to obtain the encryption key locally without direct server involvement during data operations. The terminal device facilitates key agreement between the portable device and the data owner, allowing the portable device to operate independently while maintaining centralized control through the revocation mechanism.
3Reliability
If encryption keys are stored on a remote server, then security against local device compromise is improved, but vulnerability to centralized attacks increases
Solution Approach 1:
The encryption key is extracted from the remote server and stored locally in the portable device's memory. This eliminates the single point of failure at the server, as the key now resides distributed across the portable device. Even if the server is compromised, the encryption key remains secure in the portable device, protecting against centralized attacks.
Solution Approach 2:
The system changes the storage location parameter of the encryption key from centralized (remote server) to distributed (portable device). This parameter change transforms the security model from server-centric to device-centric, reducing vulnerability to centralized attacks while maintaining security through the revocation mechanism that allows the data owner to revoke access rights.
4Reliability
If the portable device must contact the remote server to access encrypted data, then centralized authentication is improved, but offline access capability deteriorates
Solution Approach 1:
The authentication and key acquisition process is performed in advance before the portable device needs to access encrypted data. The portable device obtains the encryption key through a key agreement protocol with the terminal device and stores it locally. This preliminary authentication enables the portable device to access encrypted data offline without needing to contact the remote server during actual data operations.
Solution Approach 2:
The authentication process is segmented into two phases: an initial authentication phase where the portable device obtains the encryption key through key agreement with the terminal device, and a data access phase where the portable device operates independently using the stored key. This segmentation enables offline access capability while maintaining centralized authentication control through the revocation mechanism.
Data Source
AI summary
Implementations of the disclosure provide for binding data to a network in the presence of an entity with revocation capabilities. A cryptographic system is provided that includes a memory to store revocation information comprising a plurality of identifiers and a processing device operatively coupled to the memory. A provisioning public key is recovered in view of a first intermediate public key associated with a client device storing encrypted data. A binding identifier is generated for the client device in view of the provisioning public key. It is determined whether access to the encrypted data associated with the binding identifier is revoked or allowed in view of the revocation information. Responsive to determining that the access is allowed, provide a second intermediate public key to derive an encryption key to access the encrypted data in view of at least the provisioning public key and the first intermediate public key.