Data-File Transmission With Temporary-Key Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data transmission systems face vulnerabilities in managing access rights due to password-based encryption methods like PGP, which are not feasible for systemic management, and conventional file servers are susceptible to unauthorized access due to design flaws or configuration oversights.
Innovation Solution
A system and method using public and private key pairs, temporary keys, and identity authentication to securely transmit and manage access rights, involving key establishment and encryption protocols like ECDH and AES-GCM, ensuring secure file transmission and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based encryption methods like PGP are used, then data transmission security is improved, but ease of operation deteriorates due to requirements of creating passwords and designating transmission channels
Solution Approach 1:
The patent introduces a key server as an intermediary component that automatically manages key distribution and authentication. Instead of users manually creating passwords and designating channels, the key server mediates the entire process by automatically generating keys, distributing them to authorized users, and managing access rights, thereby maintaining security while dramatically improving ease of operation
Solution Approach 2:
The system implements self-service automation where the key server automatically performs key generation, distribution, and management without requiring user intervention. The system autonomously handles authentication processes and access right assignments, eliminating manual password creation and channel designation while maintaining robust security through automated cryptographic processes
2Ease of operation
If conventional file server access control is used, then ease of operation is improved, but reliability deteriorates due to design flaws or configuration oversights allowing unauthorized access
Solution Approach 1:
The patent replaces conventional mechanical access control systems (based on usernames, passwords, and permission settings) with a cryptographic system based on public-key infrastructure. Instead of relying on configuration-based access control that is vulnerable to design flaws, the system uses mathematical cryptography where access rights are enforced through cryptographic key pairs, making unauthorized access computationally infeasible even if system configurations are compromised
Solution Approach 2:
The system performs preliminary authentication and key establishment before any file access operations. By pre-establishing cryptographic credentials and authentication mechanisms, the system ensures that even if configuration oversights occur later, the fundamental access control security is maintained through the pre-established cryptographic relationships between users and files
Data Source
AI summary
A first user device has first public and private keys and a file encryption key for encrypting the specified file into an encrypted file. A second user device has second public and private keys. A server is in communication with the first and second user devices. The first user device generates temporary public and private keys, performs a first key establishment with the second public key, first private key and temporary private key to generate a shared secret, and uses the shared secret to encrypt the file encryption key into an encrypted key. The server allows the first user device to transmit the first public key, temporary public key, encrypted key and encrypted file to the second user device therevia if both of the first and second user devices pass the identity authentication performed thereby; and the server or the second user device uses the first public key, second private key and temporary public key to perform a second key establishment to retrieve the shared secret, and uses the shared secret, encrypted key and encrypted file to retrieve the specified file for the second user device to access.