Control Application Proxying Commands to Encrypted Data Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypting and managing encrypted data on mobile devices with limited resources face challenges in making encrypted files accessible to third-party applications securely, updating access policies, and efficiently generating and managing encryption keys, especially when devices rarely connect to a central control center.
Innovation Solution
A method that enables timely passing of commands to data access applications on a computing device by using a control application to proxy actions and policies, employing encryption keys such as shared secret keys from Diffie-Hellman key exchanges or public/private key pairs, and allowing secure key negotiation and authentication to ensure secure and convenient access to encrypted data, even when the data access applications do not directly connect to the remote control server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted and stored in containers with access policies, then security against unauthorized access is improved, but ease of access for authorized users deteriorates
Solution Approach 1:
The patent introduces a container application as an intermediary between the encrypted data containers and users/third-party applications. This mediator manages the complexity of encryption/decryption operations and access policy enforcement, allowing authorized access without exposing security mechanisms to end users.
Solution Approach 2:
The system segments access control by implementing different access policies for different applications and users. The container application can grant specific applications permission to access particular containers while maintaining security through fine-grained policy control.
2Adaptability or versatility
If multiple different types of files are stored in containers, then versatility of the container application is improved, but device complexity increases
Solution Approach 1:
The container application is designed as a universal platform that can handle multiple file types through a standardized interface. Rather than incorporating specialized code for each file type, the application provides generic container management capabilities that work across different data formats and applications.
3Extent of automation
If encryption keys are generated and stored locally on user devices, then independence from central control center is improved, but ability to update access policies deteriorates
Solution Approach 1:
The system performs preliminary actions by establishing secure key exchange mechanisms (such as Diffie-Hellman) during initial container creation or connection. Access policies and encryption keys are preliminarily configured to enable independent operation, while maintaining the capability for later updates when connectivity is available.
4Ease of operation
If third-party applications are granted access to encrypted data, then ease of operation is improved, but security risk increases
Solution Approach 1:
The container application serves as a trusted intermediary that mediates all access requests from third-party applications. It enforces access policies, manages authentication, and controls the decryption process, ensuring that even if third-party applications have vulnerabilities, the security model remains intact through the mediating layer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Data is stored on a computing device in encrypted form in respective digital containers. At least one data access application (116) is stored on the computing device. A control application (114) of the computing device connects to a remote control center (400). A command (410) from the remote control center (400) is received at the connected control application (114). The command (410) contains an action to be taken in respect of at least one of the at least one data access application (116) and the containers stored on the computing device. The command (410) is passed from the connected control application (114) to the data access application (116) or container, and the data access application (116) or container carries out the command (410).