Data Sharing Key Hierarchy for Pre-Publication Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing systems prevent users from accessing data before it is generated or published, limiting access control flexibility.
Innovation Solution
A method where a data owner derives a publisher key based on an owner key and provides it to a data publisher, who then generates a symmetric access key based on data attributes, while the owner also derives and provides a symmetric access key to the user for decryption, allowing access to encrypted data before publication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption concepts are used for access control in data sharing, then data security is improved, but user access before data publication is prevented
Solution Approach 1:
The system performs preliminary key derivation and distribution before data publication. The data owner derives a publisher key in advance and provides it to the data publisher, who then derives symmetric access keys for specific data subsets. This preliminary action enables users to access data before formal publication while maintaining security through pre-established cryptographic keys.
Solution Approach 2:
The publisher key acts as an intermediary between the owner key and the symmetric access keys. Instead of directly using the owner key for data encryption, the system introduces the publisher key as an intermediate layer that the data publisher can use to derive access keys, thereby enabling controlled pre-publication access while preserving the confidentiality of the owner key.
2Reliability
If the data owner keeps the owner key secret, then data security is improved, but the data publisher cannot derive access keys independently
Solution Approach 1:
The publisher key serves as a cryptographic intermediary that enables the data publisher to independently derive symmetric access keys without access to the owner key. The data owner derives the publisher key from the owner key and provides it to the publisher, creating a secure delegation mechanism where the publisher gains operational independence while the owner key remains confidential.
Solution Approach 2:
The cryptographic key hierarchy is segmented into distinct layers: the owner key held by the data owner, the publisher key derived and held by the data publisher, and symmetric access keys derived by the publisher for specific data subsets. This segmentation allows each party to operate independently within their key layer while maintaining overall system security.
Data Source
AI summary
The present disclosure relates to a method for sharing data with at least one user, wherein the data is legally owned by a data owner and to be published by a data publisher. The method comprises deriving, by the data owner, a publisher key based on an owner key held by the data owner and providing the publisher key to the data publisher. Further, the method includes deriving, by the data publisher, a symmetric access key based on the publisher key and at least one attribute of a subset of the data and encrypting the subset with the symmetric access key. The method further comprises deriving, by the data owner, the symmetric access key based on the owner key and the attribute, and providing the symmetric access key to the user to enable the user to decrypt using the symmetric access key the subset encrypted by the data publisher.