Document Security Tool with Encrypted Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing document access control systems fail to manage access at an individual document level, leading to security breaches when documents are shared, as access control information can be viewed or manipulated by unauthorized users and is not maintained or respected when documents are sent via email.
Innovation Solution
A document security tool that encrypts user access information using AES 128-bit encryption and merges it with the document, allowing access control to be maintained at an individual document level, ensuring that only authorized users can access the document, even when shared or sent via email.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access control information is stored centrally for multiple users, then access management is simplified, but security is compromised as unauthorized users can view or manipulate access information
Solution Approach 1:
The patent divides access control information into individual document-level encrypted segments rather than storing centralized access lists. Each document contains its own encrypted access information, separating the security model from centralized storage and eliminating the vulnerability to unauthorized manipulation while maintaining ease of management through automated encryption.
Solution Approach 2:
The patent extracts access control information from centralized storage and embeds it directly within each document as encrypted data. This extraction removes the dependency on centralized access lists and protects access information from being viewed or manipulated by unauthorized users who gain access to the document.
2Reliability
If access control information is embedded in documents, then document-level security is achieved, but the process becomes complex
Solution Approach 1:
The patent implements self-service automation where the system automatically encrypts user credentials, embeds them in documents, and decrypts them during access verification without requiring manual intervention. This automation reduces the perceived complexity for users while maintaining robust document-level security through cryptographic protection.
Solution Approach 2:
The patent replaces manual security management processes with automated cryptographic operations. Encryption and decryption algorithms substitute for manual access control procedures, reducing operational complexity while enhancing document-level security through machine-executable security protocols.
3Productivity
If access control information is not encrypted, then processing is faster, but security is compromised as information can be viewed or manipulated
Solution Approach 1:
The patent applies parameter changes by transforming access control information from plaintext to encrypted format using AES 128-bit encryption. This parameter transformation maintains processing efficiency while fundamentally changing the security properties of the stored information, preventing unauthorized viewing or manipulation.
4Ease of operation
If centralized access control is used, then managing multiple users is easier, but access control is not maintained at individual document level
Solution Approach 1:
The patent segments access control from the centralized level down to the individual document level by embedding encrypted access information within each document. This segmentation enables document-level access control while the automated encryption process maintains ease of user management through systematic credential protection.
Data Source
AI summary
A document security tool includes a memory and a processor. The processor receives a first command from a first user to save a document and in response: encrypts a username, email address, and job code of the first user to produce an encrypted file, merges the encrypted file with the document, and saves the document. The processor also receives a second command to access the document and in response: determines a second user who issued the command, determines a username, email address, and job code of the second user, extracts the username, email address, and job code of the first user from the document, and grants the second user access to the document if one or more of the username, email address, and job code of the second user matches one or more of the username, email address, and job code of the first user.