Client-Side Encrypted Storage With Remote Decryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing sensitive data face challenges in distributing liability and security risks between centralized servers and client devices, while also complicating the management of encryption and decryption keys, often requiring inconvenient user interactions.
Innovation Solution
A client-server system where encrypted data is stored on the client device and the decryption key is stored on a remote server, with the key being generated and managed separately, ensuring secure and convenient data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored on a centralized server, then security resources are more secure and efficient, but the technical, legal and business risk of storing sensitive data at a centralised location becomes a large liability
Solution Approach 1:
The patent divides the data storage system into two separate components: encrypted data stored on the client device and decryption keys stored on the server. This segmentation eliminates the liability risk of centralized sensitive data storage while maintaining security efficiency, as the server only holds encrypted data without the ability to decrypt it.
Solution Approach 2:
The patent extracts the decryption keys from the centralized server environment and places them on the client device, while keeping the encrypted data on the server. This extraction removes the harmful factor of centralized sensitive data storage while preserving the security benefits of server-based storage resources.
2Ease of operation
If encrypted data and decryption key are stored together on the user's computer, then user convenience is improved, but security is compromised
Solution Approach 1:
The patent segments the encryption system into two parts: encrypted data stored on the server and decryption keys stored on the client device. This allows the user to access encrypted data conveniently from any device while maintaining security, as the key never leaves the client device.
Solution Approach 2:
The patent introduces an intermediary mechanism where the server stores encrypted data and the client stores keys, with authentication serving as the mediator that enables secure access without direct key exposure. This intermediary arrangement provides both convenience and security.
3Ease of operation
If decryption key is stored on the server with encrypted data, then data access is simplified, but security risk increases
Solution Approach 1:
The patent inverts the conventional approach by storing encrypted data on the server and decryption keys on the client device, rather than storing both on the server. This inversion maintains simplified data access through the server interface while eliminating the security risk of centralized key storage.
4Reliability
If user must manage and retrieve decryption key from nearby source, then security is maintained, but user convenience deteriorates
Solution Approach 1:
The patent implements self-service by automatically managing decryption keys on the client device without requiring user intervention for key retrieval. The system automatically uses the stored key to decrypt data when needed, maintaining security while eliminating the inconvenience of manual key management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a client server environment a method of, and apparatus for, securely storing data, said method comprising: generating a data element at a second location; transmitting the data element to a first location separate and remote from the second location; encrypting the data element at the first location, using a key, thereby to form an encrypted data element; transmitting the encrypted data element to the second location separate and remote from the first location and storing the encrypted data element at the second location; and wherein the second location is constituted as a client device.