Device-Specific Encryption for Data Access Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access management systems are vulnerable to malicious access due to compromised user credentials and lack of robust security measures, allowing unauthorized access to sensitive data.
Innovation Solution
Implementing a security registration process that assigns cryptographic key pairs to user-device combinations, encrypts sensitive data using device-specific encryption, and requires independent decryption by the user, thereby enhancing data access security through validation and secure communication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control measures (user authentication) are implemented, then data access is controlled, but security is compromised when user credentials are stolen
Solution Approach 1:
The patent segments the authentication process into two independent parts: device authentication (via device-specific encryption keys) and user authentication (via user credentials). This segmentation ensures that compromising user credentials alone does not grant access, as the device-specific authentication layer remains intact and independent.
Solution Approach 2:
The patent introduces device-specific encryption keys as an intermediary authentication mechanism between the user and the data storage system. This intermediary layer verifies device identity independently of user credentials, creating a mediator that prevents direct access even when user credentials are compromised.
2Reliability
If device-specific encryption is implemented, then security against credential compromise is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-registering devices and generating device-specific encryption keys during an initial registration process. This preliminary setup creates authentication credentials in advance, allowing the system to operate securely without complex real-time key generation or management during data access operations.
3Object-affected harmful factors
If multi-layer authentication is implemented, then protection against malicious access is improved, but ease of operation decreases
Solution Approach 1:
The patent implements self-service by having the device automatically perform device-specific authentication using pre-configured encryption keys. The device independently verifies its own identity and establishes secure communication channels without requiring manual user intervention for the device authentication layer, maintaining ease of operation while enhancing security.
Data Source
AI summary
Methods and systems for managing access to data stored in data storage systems are disclosed. An end device (e.g., a data processing system) and/or user thereof may require access to sensitive data stored in a data storage system. To prevent malicious parties from gaining access to the sensitive data, an access control system may be implemented. The access control system may include a registration process that registers end device and user combinations and assigns cryptographic key pairs to each registered combination. Before sensitive data may be accessed, a requesting device and its associated user may be validated (e.g., authenticated) using the key pairs generated during registration. The sensitive data may be encrypted pre-transit using device-specific encryption (e.g., using the key pair assigned to the end device during registration) as an additional access control measure to prevent malicious parties gaining access to the sensitive data.