Client-Side Key Storage for Secure Server Data Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In distributed computing systems, especially in Software as a Service (SaaS) models, there is a disparity between data owners who lack technical control over their data stored on third-party servers, and the third-party operators who require full control for processing, leading to security vulnerabilities.

Innovation Solution

A system where client devices store encrypted data and retrieve encryption keys from secure storage to process data on servers, ensuring only the client can access and control their data, with the server deleting the encryption key post-processing to prevent unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the server operator has full control over data for processing, then data processing capability is improved, but data security and client control deteriorate

Engineering Contradiction:

Improvedata processing capabilityVSAvoiddata security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments control authority by separating data storage (on server) from decryption key storage (on client device). This allows the server to store and process encrypted data while the client retains control through exclusive possession of decryption keys, resolving the contradiction between processing capability and security control.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Encrypted data acts as an intermediary between the server and client. The server operates on encrypted data without needing decryption keys, enabling processing while maintaining security. The encryption/decryption mechanism mediates between the server's need for data access and the client's need for data protection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If encryption keys are stored on the server for processing, then data processing is improved, but unauthorized access risk increases

Engineering Contradiction:

Improvedata processing efficiencyVSAvoidunauthorized access risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system extracts the decryption key from the server environment and stores it exclusively on the client device. This removes the security vulnerability of storing keys on the server while still enabling the server to process encrypted data, as the key never resides on the server infrastructure.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Data is pre-encoded in encrypted format before being stored on the server. This preliminary encryption action ensures that even if the server is compromised, the data remains inaccessible without the decryption key, which is never stored on the server.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20240411912A1Managing access to data

Publication Date: 2024.12.12 SAGE GLOBAL SERVICES LTD

AI summary

A system and a method for managing access to data in a distributed computing system. The system includes at least one server computer including a memory device configured to store encrypted data associated with a client; and at least one client device configured to request to process the encrypted data. The client device is configured to retrieve encryption data indicative of an encryption key associated with the encrypted data from a secure storage device associated with the client, and transmit, to the server computer a request to process the encrypted data and the encryption key. The server computer is configured to, responsive to receiving the request: retrieve the encrypted data, decrypt the encrypted data using the encryption key, and fulfil the processing request to determine processed data.