Client-Side Data Encryption with Asymmetric Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems are vulnerable to network communication security threats and require manual key management, leading to inefficiencies and increased latency in data sharing and server processing.
Innovation Solution
A method using a combination of symmetric and asymmetric encryption, where a client generates a symmetric key and initialization vector to encrypt data, and then uses asymmetric encryption components provided by the server to upload encrypted data and key information independently of network security, without storing sensitive key data locally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric encryption with locally stored keys is used, then data can be encrypted before upload, but manual key copying is required and data becomes unrecoverable if keys are lost
Solution Approach 1:
The patent introduces a server as an intermediary that manages asymmetric key pairs and handles key distribution. The server generates asymmetric keys, stores them securely, and provides them to clients during upload sessions, eliminating the need for manual key copying and recovery while maintaining security.
Solution Approach 2:
The patent uses asymmetric encryption where the client copies only the public key from the server to encrypt the symmetric key, while the private key remains securely stored on the server. This allows secure key management without manual intervention.
2Adaptability or versatility
If asymmetric certificate signing is used for data sharing, then data can be shared between clients, but server processing time increases due to certificate generation for each request
Solution Approach 1:
The patent generates asymmetric key pairs in advance during server initialization or session setup, rather than creating new certificates for each upload request. The pre-generated public keys are stored on the server and reused for multiple uploads, significantly reducing processing time while maintaining secure data sharing capability.
3Reliability
If SSL/TLS network security protocols are used, then encrypted communication between client and server is achieved, but vulnerability to Man-in-the-Middle and SSL Downgrade attacks persists
Solution Approach 1:
The patent applies encryption before data leaves the client device, creating a security layer that exists independent of network transmission security. By encrypting data locally with symmetric encryption and protecting keys with asymmetric encryption, the system cushions against potential network attacks including SSL/TLS vulnerabilities.
Solution Approach 2:
The patent acknowledges that network security cannot be fully trusted and converts this potential harm into a benefit by making the system's security independent of network security. The encryption scheme is designed to work even if network protocols are compromised, turning the weakness of relying on network security into a strength through cryptographic independence.
4Device complexity
If encrypted data and keys are stored on the server, then centralized management is achieved, but security is compromised as the server has access to unencrypted key data
Solution Approach 1:
The patent segments the key management system into distinct components: the server stores only asymmetric key pairs and encrypted symmetric keys, while the client holds the capability to encrypt data with symmetric keys. This segmentation ensures the server never possesses unencrypted symmetric keys, maintaining security while enabling centralized management of encrypted data.
Solution Approach 2:
The server acts as an intermediary that facilitates key distribution and data management without compromising security. It generates and stores asymmetric keys, manages encrypted symmetric keys, and coordinates uploads, but never holds unencrypted symmetric encryption keys, thus maintaining both centralized management and security.
Data Source
AI summary
Systems and methods for securely uploading a data file are presented. A client generates a symmetric encryption key and an initialization vector; encrypts the data file using the symmetric encryption key and the initialization vector; places an upload request with a server to upload the encrypted data file to a first storage device; receives from the server via the communications network, asymmetric encryption components, a signed data file upload URL accessible by the communications network, and a signed key data upload URL accessible by the communications network; encrypts, using the asymmetric encryption components, the symmetric encryption key and the initialization vector, thereby creating encrypted key information; sends, via the signed data file upload URL, the encrypted data file to the first storage device; and sends, via the signed key data upload URL, the encrypted key information to a second storage device.