Encrypted Resource Access Control via Key Server Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hosted storage systems face challenges in securely managing access to encrypted data resources, particularly in ensuring that only authorized users can decrypt and access encrypted data stored in cloud-based storage services.
Innovation Solution
A method and system where encrypted resources are stored with an access control list specifying a group identifier and a wrapped key, which includes an encrypted resource encryption key. This system uses a key server to authenticate users and provide the unencrypted resource encryption key only if the authentication credentials match the group identifier, allowing secure decryption and access to the resource.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted resources are stored with access control lists and wrapped keys in hosted storage systems, then security and authorized access control are improved, but system complexity increases due to the need for key management, authentication verification, and decryption operations
Solution Approach 1:
The system segments key management by separating the resource encryption key from the access control mechanism. The wrapped key contains the resource encryption key encrypted with a key encryption key, allowing fine-grained control over who can access which resources without exposing all keys system-wide.
Solution Approach 2:
The key server acts as an intermediary between the hosted storage system and users. It receives wrapped keys and authentication credentials, verifies authorization, and provides the unencrypted resource encryption key only to authorized users, thereby mediating the complexity of key management.
2Reliability
If a key server system is introduced to manage wrapped keys and authenticate users, then access security is improved, but the number of system components and communication overhead increases
Solution Approach 1:
The key server performs multiple functions: storing wrapped keys, receiving authentication credentials, verifying user authorization, and providing unencrypted resource encryption keys. This multi-functionality consolidates what would otherwise be separate components into a single authorized access gateway.
3Reliability
If the resource encryption key is encrypted and stored in the wrapped key, then data protection is improved, but the time required for decryption and key retrieval increases
Solution Approach 1:
The resource encryption key is pre-encrypted and stored in the wrapped key before the actual data is stored. This preliminary encryption action ensures that when data needs to be accessed, the key is already prepared in an encrypted state, and only needs to be decrypted and provided to authorized users, reducing real-time decryption delays.
Data Source
AI summary
An encrypted resource is stored in association with an access control list. A request to retrieve the resource is received. The wrapped key and the authentication credentials are sent, from the application server system, to a key server system. An unencrypted version of the resource encryption key is received from the key server system if the key server system determines that the authentication credentials correspond to a user in the group of users identified by the group identifier. The stored encrypted resource is decrypted using the received unencrypted version of the resource encryption key to generate an unencrypted version of the resource. The unencrypted version of the resource is sent, from the application server system, to the client application.