Credential Sharing via Intermediary Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing credential management systems face challenges in securely sharing credentials between users without compromising security, as direct sharing of secure details can introduce vulnerabilities and grant unintended access.
Innovation Solution
A method of encrypting secure details using a unique session key specific to each sharing instance, where the encrypted session key is further encrypted with the recipient's public key, allowing only the intended user to decrypt and use the credentials, with the option to revoke certificates for secure key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If secure details are shared directly between users, then access control is enabled, but security vulnerabilities increase
Solution Approach 1:
The patent introduces a credential server as an intermediary between credential owners and recipients. The server manages encryption keys and facilitates secure credential transfer without direct user-to-user sharing. The server acts as a mediator that generates session keys, encrypts credentials, and manages the sharing lifecycle, eliminating the need for direct secure detail transmission between users.
Solution Approach 2:
The patent creates encrypted copies of credentials rather than sharing original secure details. Each credential receives a unique encrypted version containing the session key and encrypted credential data. This copying approach allows multiple users to access credentials securely without exposing the original secure details, as each user receives a separate encrypted copy tailored to their access needs.
2Adaptability or versatility
If credentials are shared with multiple users, then access flexibility improves, but control over credential usage deteriorates
Solution Approach 1:
The patent segments credential access by creating separate encrypted copies for each user or group. Each segment contains credentials encrypted with a unique session key, allowing fine-grained control over who can access what. The system can segment credentials at the user level, group level, or machine level, enabling flexible access patterns while maintaining precise control through individual encryption keys.
Solution Approach 2:
The patent implements dynamic credential sharing where access rights can be changed in real-time. The credential server can revoke or modify access to specific segments dynamically without affecting other users. Session keys can be rotated, and credential assignments can be updated during operation, allowing the system to adapt access control policies dynamically while maintaining security.
3Ease of operation
If default credentials are provided to users, then ease of login improves, but security checks are removed
Solution Approach 1:
The patent employs disposable session keys that are generated specifically for each credential sharing instance. These session keys are temporary and single-use, unlike permanent default credentials. After the credential is accessed and the session completes, the session key is discarded. This approach provides convenient access during the active session while eliminating long-term security risks associated with default credentials.
Solution Approach 2:
The patent performs preliminary encryption of credentials before sharing them with users. The credential server encrypts credentials with session keys before transmitting them to users or machines. This preliminary action ensures that credentials are never stored or transmitted in plaintext, maintaining security checks even during the login process. The encryption happens in advance, so when users need access, they simply decrypt the pre-encrypted credentials.
Data Source
AI summary
A method of credential sharing between users in a system includes creating a credential for a first user that is configured such that entry of secure details of the credential enables execution of an operation. The method includes receiving data indicative of a first selection of the credential and a second selection of a second user. The method includes encrypting the secure details such that the second user is capable of decrypting the secure details and other users are incapable of decrypting the secure details. The method includes appending a profile of the second user with encrypted secure details. The method includes receiving an execution request to perform the first operation from the second user and decrypting the secure details. After entry of the decrypted secure details, the method includes authenticating the second user using the secure details and enabling execution of the first operation by the second user.