Data Passport Key Management System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods face challenges in securely exchanging and managing symmetric keys, particularly due to the need for direct relationships between parties, slow key transfer, and vulnerabilities in key management systems, which can result in data loss if components break or encounter issues.
Innovation Solution
A method and system that uses session keys and Key Management System (KMS) keys and compartmentalization keys to encrypt and decrypt data, with a data passport containing indices for key decryption, allowing secure data transmission and management without direct key exchange between parties, and automatic key generation and distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric keys are exchanged using traditional methods (encryption or paper delivery), then key security can be maintained, but the key exchange process becomes slow and requires direct relationship establishment between parties
Solution Approach 1:
The patent introduces a Key Management System (KMS) as an intermediary that generates and manages symmetric keys. The KMS creates session keys, encrypts them with asymmetric key pairs, and distributes them automatically without requiring direct relationship establishment between communicating parties. This mediator approach eliminates slow paper delivery and complex direct key exchange protocols while maintaining security through cryptographic protection.
Solution Approach 2:
The patent segments the key management process into distinct components: asymmetric key pair generation, session key generation, encryption of session keys, and distribution through the KMS. By dividing the key exchange process into these modular segments, the system achieves faster automated key distribution while maintaining security through layered cryptographic protection.
2Reliability
If direct relationship establishment is required for key exchange, then key management can be controlled, but the system complexity increases significantly when many users are involved
Solution Approach 1:
The Key Management System (KMS) serves as a universal platform that handles key generation, encryption, and distribution for all users in the system. Instead of requiring separate direct relationships between each pair of users, the KMS provides a multi-functional service that works for any number of users, thereby reducing system complexity while maintaining controlled key management through centralized cryptographic operations.
Solution Approach 2:
The KMS acts as an intermediary that eliminates the need for direct relationship establishment between users. The system uses asymmetric key pairs and encrypted session keys as mediators to enable secure communication without requiring users to have pre-established relationships, thereby significantly reducing system complexity for multi-user environments.
3Productivity
If keys are stored and managed in a centralized system, then key selection can be automated, but the system becomes vulnerable to component failures and data loss
Solution Approach 1:
The patent implements beforehand cushioning by encrypting session keys with asymmetric key pairs before storage in the KMS. This pre-encryption protection ensures that even if the centralized key management system experiences component failures or security breaches, the encrypted session keys remain protected and cannot be easily compromised, thereby reducing system vulnerability while maintaining automated key selection.
Solution Approach 2:
The system changes the cryptographic parameters by using asymmetric key encryption to protect symmetric session keys. This parameter change in the encryption approach provides an additional layer of security for the centralized key storage system, making it more resilient to failures and attacks while preserving the benefits of automated key management and selection.
4Productivity
If business logic is predefined for key selection, then data protection can be automated, but the system has obvious break points where security can be compromised
Solution Approach 1:
The patent employs a composite cryptographic approach that combines asymmetric key encryption with symmetric session key encryption. This composite security model creates multiple layers of protection, making the system more resilient to attacks on any single component. The automation of data protection is maintained through the KMS, while the layered cryptographic structure eliminates obvious security break points by requiring multiple cryptographic breaks simultaneously.
Solution Approach 2:
The system applies beforehand cushioning by pre-encrypting session keys with asymmetric keys before they are used for data protection. This prior cryptographic protection creates a buffer that prevents direct attacks on the automated key selection process, thereby maintaining productivity while reducing security vulnerabilities in the business logic implementation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for transmitting data involves receiving the data, identifying, by a sender system, a first data element in the data to protect, encrypting, by the sender system, the first data element with a sender session key, generating, by the sender system, a combined key using a receiver key value and a sender compartmentalization key (SK). The method also involves encrypting, by the sender system, the sender session key using the combined key to obtain an encrypted session key, generating, by the sender system, a data passport comprising the encrypted session key, a dictionary classification key (DK) index, a SK index, and a receiver compartmentalization key (RK) index, generating, by the sender system, protected data comprising the data passport and the encrypted first data element, and transmitting, by the sender system and across a network, the protected data to a receiver system.