Distributed Key Segmentation for Secure Client Data Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely transmitting and storing client data during sessions with server-based applications, as they often require repeated authentication credentials and lack effective encryption methods to prevent unauthorized access.
Innovation Solution
The solution involves generating a combined encryption key using a static key portion, a session key portion, and a client key portion, where the session key is stored on the server and the client key is provided to the remote client, allowing for secure encryption and decryption of client data, with the client key being deleted from the server to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are temporarily stored on the server to avoid repeated user prompting, then ease of operation is improved, but data security deteriorates due to increased risk of unauthorized access
Solution Approach 1:
The encryption key is divided into multiple segments: a server-stored portion and a client-held portion. The client data is encrypted using both portions, so that neither the server nor the client alone can decrypt the data. This segmentation resolves the contradiction by allowing the server to store credentials securely while requiring client cooperation for decryption, thus maintaining both ease of operation and data security.
2Device complexity
If a single master key is used for all client data encryption, then device complexity is reduced, but data security deteriorates due to increased impact of key compromise
Solution Approach 1:
Instead of using a single master key, the system segments the key into multiple portions distributed between server and client. Each client data encryption requires both the server's key portion and the client's key portion, effectively creating multiple independent security layers that reduce the impact of any single key compromise while maintaining manageable complexity through automated key management.
Solution Approach 2:
Different key portions are held locally at different locations (server and client), with each location having specific security responsibilities. The server stores its key portion and encrypted data, while the client stores its key portion and can provide decrypted data when needed. This local quality distribution ensures that compromise at one location does not affect security at another location.
3Object-affected harmful factors
If credentials are transmitted repeatedly for authentication, then data security is improved through fresh authentication, but loss of time increases due to repeated user prompting
Solution Approach 1:
The system performs preliminary encryption of client data using the distributed key portions during the initial authentication phase. Once encrypted, the data can be accessed by both server and client without requiring repeated authentication credentials, thus maintaining security through initial fresh authentication while eliminating repeated prompting and reducing time loss.
Data Source
AI summary
In some embodiments, a server can establish a session with a remote client. The server can generate a session key portion for the session and a client key portion for the remote client. The server can use a combined encryption key to encrypt client data received from the remote client during the session. The combined encryption key can be generated from a static key portion accessible by the server, the session key portion, and the client key portion. The server can associate the session key portion with the session. The session key portion is accessible by the server during the session. The server can delete the client key portion after providing the client key portion to the remote client. The server can obtain the client key portion from the remote client in response to determining that subsequent transactions during the session involve decrypting the encrypted client data.