Cryptographic Data Storage Access Control System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic systems are not effectively used for secure communication and data storage due to complexity, requiring users to manage multiple keys and trust third parties, while also lacking transparency in data transmission and storage routes.
Innovation Solution
A system that uses a record of user accounts with public and private encryption keys, access control lists (ACLs) for permissions, and an access controller to manage encrypted data storage and access, ensuring secure communication without requiring users to trust third parties with unencrypted data or keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users manage multiple cryptographic keys and trust third parties, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system allows users to independently generate and manage their own cryptographic key pairs without requiring third-party key management services. Each user maintains control of their private key while the server stores only public keys, enabling self-service security management that eliminates the need for users to trust external key management authorities.
Solution Approach 2:
The cryptographic system is segmented into distinct components: user-generated private keys, server-stored public keys, and automatically generated symmetric session keys. This segmentation separates key management responsibilities, with users managing asymmetric keys and the system managing symmetric keys, reducing the operational burden on users while maintaining security.
2Reliability
If cryptographic systems are implemented, then security is improved, but device complexity increases
Solution Approach 1:
The server acts as an intermediary that automatically manages symmetric key generation, encryption, and decryption operations. Users only need to manage their asymmetric key pairs, while the server handles the complexity of symmetric cryptography, session key management, and data encryption/decryption, thereby reducing the perceived complexity for end users.
Solution Approach 2:
The system merges asymmetric and symmetric encryption approaches into a unified framework. Asymmetric keys are used for secure key exchange and authentication, while symmetric keys handle bulk data encryption. This combination leverages the security benefits of asymmetric cryptography with the efficiency of symmetric cryptography, creating a comprehensive security solution.
3Adaptability or versatility
If data is transmitted over untrusted networks, then communication versatility is improved, but reliability deteriorates
Solution Approach 1:
The system applies preliminary cryptographic protection to data before transmission. Symmetric keys are generated and data is encrypted before leaving the user's device, and asymmetric encryption is used to protect key exchange. This preliminary security measure ensures that even if data traverses untrusted networks, the confidentiality and integrity are maintained throughout the communication pathway.
Data Source
AI summary
Various exemplary embodiments relate to a system for storing encrypted data and providing access to a group of users. The system may include: a record of user accounts including: a user identifier and a public encryption key; an access control list (ACL) defining an access control policy including: permissions defining access to data objects associated with the ACL and an ACL key list including copies of a an ACL key encrypted with the public keys of the users; a user-data storage medium including: encrypted user data, stored as a plurality of data objects, each object associated with an ACL and encrypted with the ACL key, and meta-data; and an access controller configured to: receive a request for a data object, and send a copy of the data object and the ACL key encrypted with the public key of the user if the user has permission to access the data object.