Distributed File Encryption via Hardware Token Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage methods using external services like OneDrive and Dropbox are limited by security concerns, cost, and availability, often requiring users to register with multiple services, leading to inefficient data backup and storage solutions.
Innovation Solution
A method involving file encryption with a symmetric key, fragmentation using an error correction method, and distribution across multiple storage services, with metadata encrypted and stored securely on a hardware token, allowing for decentralized access and reconstruction of files while preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file fragments are stored distributed across multiple storage services, then data availability and security are improved, but device complexity and authentication overhead increase
Solution Approach 1:
The file is divided into multiple fragments and distributed across different storage services. Each fragment is stored separately, so that no single storage service holds the complete file. This segmentation improves reliability because the file can be reconstructed from a subset of fragments even if some storage services fail.
Solution Approach 2:
A centralized authentication server is introduced as an intermediary to manage authentication tokens and coordinate access to distributed file fragments. The authentication server issues tokens that enable clients to access specific fragments from different storage services without requiring complex peer-to-peer authentication between multiple services.
2Reliability
If error correction procedure is executed to generate file fragments, then data reliability is improved, but loss of information increases due to correction bits
Solution Approach 1:
Error correction bits are pre-calculated and embedded into file fragments before distribution to storage services. This preliminary action ensures that if any fragments are lost or corrupted during storage or transmission, the error correction mechanism can reconstruct the original file without requiring retransmission or additional storage.
3Reliability
If metadata is encrypted and stored separately, then data security is improved, but ease of operation deteriorates due to decryption requirements
Solution Approach 1:
The system implements automated decryption of metadata using stored private keys when authorized clients request file fragments. The decryption process occurs automatically as part of the authentication and access workflow, so that authorized users experience no manual overhead despite the encryption providing enhanced security.
4Reliability
If authorization tokens are requested from each storage service, then access control security is improved, but productivity decreases due to multiple authentication steps
Solution Approach 1:
Authentication tokens are pre-issued by the centralized authentication server before clients need to access distributed file fragments. This preliminary authentication action eliminates the need for repeated authentication handshakes with each storage service during file access operations, significantly improving access speed while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for processing a file (101), comprising: - sending an access request from a user computer system (104, 162, 168) to a file management server (130) to access a distributed file (101); - authenticating the user computer system (104, 162, 168) to the file management server (130); - receiving an authorization token from each of the storage services of at least a selection of the storage services (SD1-SD6) in whose non-volatile storage media (SM1-SM6) the file fragments (F1-F4) are stored, via the file management server (130); - downloading the file fragments (F1-F4) from the individual storage services using the authorization tokens and bypassing the file management server (130); - Sending a decryption request from the user computer system (104, 162, 168) to access the decrypted metadata (311) to the hardware token (103, 167);- Authenticating the user computer system (104, 162, 168) to the hardware token (103, 167); - Receiving the metadata (311) decrypted by the hardware token (103, 167) with the private key (138, 172); - Reconstructing the encrypted file (101) from the file fragments (F1-F4) using the metadata (311); - Decrypting the encrypted file (101) with the symmetric key (319) contained in the metadata (311).