DID Personal Storage Encryption for Private Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized identity management systems lack privacy and security for user data, as they rely on centralized authorities and can compromise user privacy by correlating relationships between different identities.
Innovation Solution
A blockchain-based identity management system using Decentralized Identifiers (DIDs) encrypts data objects with a passphrase and personal storage identifier, allowing access through a DID management module and sharing with other entities via negotiated protection strategies, ensuring privacy by not recording the other entity's identifier in metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in centralized identity management systems, then access and verification are simplified, but user privacy and security are compromised
Solution Approach 1:
The system segments data storage by encrypting data locally on the user's device rather than storing it centrally. Each data object is encrypted with a unique key derived from the user's passphrase and storage identifier, allowing data to be distributed across multiple locations without creating a centralized target for breaches.
Solution Approach 2:
The patent introduces encryption as an intermediary layer between the user's data and the centralized system. The encryption/decryption key acts as a mediator that allows authorized access while preventing unauthorized access, even when data is stored on centralized servers or in cloud storage.
2Object-affected harmful factors
If data is encrypted with a passphrase, then security is improved, but ease of access deteriorates
Solution Approach 1:
The system performs preliminary action by automatically generating and storing the encryption/decryption key when the user first sets their passphrase. The key is derived from the passphrase and storage identifier, and is stored in a secure manner, eliminating the need for users to manually manage complex encryption keys while maintaining strong security.
Solution Approach 2:
The system enables self-service by automatically handling the encryption and decryption processes. When a user accesses data, the system automatically retrieves the appropriate key, decrypts the data, and provides access without requiring manual intervention. The DID management module handles key retrieval and data decryption automatically based on the user's authentication.
3Productivity
If service providers track user identifiers, then service delivery is improved, but user privacy is compromised
Solution Approach 1:
The patent extracts and removes identifiable information from the data storage and transmission process. Instead of storing user identifiers or metadata that could link data to specific users, the system uses encrypted data objects with only essential encryption metadata. This extraction of identifying information prevents service providers from correlating user identities while maintaining service functionality.
Solution Approach 2:
The system changes the parameters of data storage by transforming identifiable data into encrypted form. The data objects are encrypted using keys derived from passphrases and storage identifiers, transforming the data from a readable, identifiable format into an encrypted format that cannot be correlated to specific users without the proper decryption key.
4Adaptability or versatility
If data is stored in personal storage associated with DID, then user control is improved, but device complexity increases
Solution Approach 1:
The system implements universality by using a single encryption key derivation mechanism that works across all data objects and storage locations. The same passphrase-based key derivation function is used whether data is stored locally, in cloud storage, or on different devices, simplifying the user experience while maintaining consistent security and control across the entire ecosystem.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Encrypting and sharing one or more data objects stored or to be stored in a personal storage that is associated with a DID. First an encryption/decryption key is generated using a passphrase and an identifier of the personal storage that stores or is to store a data object in the personal storage. The data object stored or to be stored in the personal storage is then encrypted by the generated encryption/decryption key. The encrypted data object is then stored in the personal storage. The encrypted data object may then be accessed by a DID management module that is configured to manage the DID or be shared to another entity that is not associated with the DID.