Data Sharing System With Local Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing systems face challenges in securely sharing sensitive data among organizations, risking information leakage and illegal use due to the transmission of encryption keys across servers for statistical analysis.
Innovation Solution
A data sharing system where sensitive data is encrypted by each organization's server, with a management server integrating and processing encrypted data, and requesting decryption from the originating server, ensuring that sensitive data and processing results remain secure within their respective domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a service providing server transmits an encryption key to all other service providing servers for data encryption, then statistical analysis can be performed by a third party organization, but information security risks such as information leakage and illegal use increase
Solution Approach 1:
The patent extracts the encryption key management function from the data sharing process. Each service providing server independently manages its own encryption keys and encrypts its data locally before transmission. The third party organization receives only encrypted data without access to decryption keys, eliminating the security risk of key transmission while maintaining data sharing capability.
Solution Approach 2:
The patent segments the data sharing system into independent units where each service providing server operates autonomously with its own encryption key. This segmentation prevents a single point of failure and ensures that compromise of one server's key does not affect others, thereby improving information security while enabling data sharing.
2Adaptability or versatility
If encryption keys are transmitted across multiple servers, then data can be encrypted and shared, but the complexity of key management increases
Solution Approach 1:
Each service providing server independently generates and manages its own encryption keys without relying on other servers for key distribution. This self-service approach eliminates the complexity of inter-server key management while maintaining the ability to share encrypted data across the network.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a data sharing system, data possessed by a company is safely utilized without disclosing the content of the data to the other companies. A data providing server includes: a sensitive data acquisition unit configured to acquire sensitive data; a key management unit configured to manage a key; and an encryption unit configured to encrypt at least a part of an attribute value of the sensitive data by a predetermined encryption scheme based on an encryption key. A common database is configured to store an integrated data obtained by integrating the sensitive data encrypted in a plurality of data providing servers based on an identifier. A management server includes: a reception unit configured to receive a processing request of a data processing processed to the integrated data stored in the common database; an execution unit configured to execute the data processing; and a decryption request unit configured to transmit a processing request of a decryption processing to the data providing servers for requesting the data providing servers to decrypt the execution result of the data processing. The data providing servers further include a decryption unit configured to decrypt the execution result based on a decryption key in accordance with the processing request of the decryption processing transmitted from the decryption request unit of the management server.