Client-Side Encryption Key Management for Secure File Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current online file storage systems lack secure and reliable methods for storing and accessing files, particularly in terms of data integrity, access tracking, and protection against insider threats and hacking, as they rely on insecure encryption methods and third-party involvement.
Innovation Solution
A secure file storage system that uses client-side encryption with a unique encryption key, eliminating the need for third-party involvement by ensuring encryption keys are not stored on the server, and implementing an encryption mark for synchronization between client and server, allowing users to verify the compatibility of encryption algorithms and keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted using account password stored on server, then file storage service is provided, but security is compromised as passwords can be reversed and files accessed by unauthorized users
Solution Approach 1:
The patent extracts the encryption key management function from the server side and places it entirely on the client side. The server stores only encrypted files and cannot access decryption keys, eliminating the security vulnerability of stored passwords while maintaining file storage functionality.
Solution Approach 2:
The system segments the encryption process into client-side key generation and server-side file storage. Encryption keys are generated and stored locally on client devices, separated from the server infrastructure, allowing secure file storage without centralized key management vulnerabilities.
2Ease of operation
If encryption keys are stored on server for authentication, then file access is enabled, but vulnerability to hacking and insider threats increases
Solution Approach 1:
The patent removes encryption keys from server storage entirely, extracting this critical security element to client-side only. The server can provide file access functionality but cannot compromise keys, eliminating insider threat vulnerabilities while maintaining operational ease through client-managed authentication.
3Device complexity
If hashed passwords are used for encryption, then authentication is simplified, but security is weakened as hashes can be reversed to original passwords
Solution Approach 1:
The patent extracts password hashing from the authentication process entirely, replacing it with client-side encrypted key storage. Instead of hashing passwords on the server, the system uses client-generated encryption keys that are never transmitted or stored on the server, eliminating reversal vulnerabilities while maintaining simple authentication.
4Reliability
If third-party key management is implemented, then encryption synchronization is achieved, but trust in third parties is required
Solution Approach 1:
The patent implements self-service encryption key management where each client device independently generates and manages its own encryption keys. The system achieves synchronization through cryptographic protocols without requiring third-party key management services, eliminating trust requirements while maintaining encryption consistency across devices.
Data Source
AI summary
The claimed invention is a method for encryption synchronization and user authentication, which allows a user to set up an encrypted mark created by using an encryption algorithm and a user-provided encryption key. The method does not leave any information that would be used by internal staff or an authentication service provider to acquire user account credentials, and thus preventing hackers from acquiring such information to be used to gain unauthorized access to stored user data.