Encryption Key Management in Data Subscription Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data subscription systems, existing technologies face challenges in preventing illegal data sharing and duplication, ensuring data integrity, and efficiently managing encryption keys due to frequent changes and revocations in a multi-user environment.
Innovation Solution
A method and apparatus for encryption key management in a data subscription platform that involves encrypting a master key with public keys of supplier and subscriber terminals, deriving a symmetric key based on the master key, data identifier, and key update count value, and facilitating key updates and revocations to secure data transmission and usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a typical PKI is used for data encryption and integrity verification, then data security is improved, but key management complexity increases due to frequent generations, changes, and revocations of keys in multi-user environment
Solution Approach 1:
The system segments key management into hierarchical levels: master keys at the platform level, subscription keys at the service level, and data keys at the content level. This segmentation allows independent management of different key types, reducing overall complexity while maintaining security. Each level operates autonomously, enabling frequent key rotations without affecting the entire system.
Solution Approach 2:
The patent introduces key management servers as intermediary components between users and the PKI system. These servers handle key generation, distribution, rotation, and revocation operations, shielding end users from complex key management tasks. The intermediary layer abstracts the complexity of frequent key changes while maintaining security protocols.
2Reliability
If encryption keys are frequently generated and revoked to prevent illegal data sharing, then security against illegal sharing is improved, but system operation efficiency deteriorates
Solution Approach 1:
The system performs preliminary key generation and distribution when users subscribe to services, before any actual data access occurs. Subscription keys are pre-established, allowing immediate secure data access without delays. Key revocation is also prepared in advance through credential validation mechanisms, enabling quick termination of access rights when needed.
Solution Approach 2:
The patent implements dynamic key parameters including time-limited validity periods, usage counters, and scope restrictions. Keys can be configured with different lifecycles and permissions, allowing efficient key rotation strategies that balance security requirements with operational efficiency. Parameter changes enable flexible key management without requiring complete key regeneration.
3Reliability
If multiple encryption keys are managed for multiple subscribers, then security coverage is improved, but key management complexity increases
Solution Approach 1:
The system implements universal key management functions that handle multiple subscribers through a unified interface. The key management server provides multi-functional capabilities including key generation, distribution, rotation, and revocation that work consistently across all subscribers regardless of their specific requirements. This universality reduces complexity by eliminating the need for separate management systems for different user groups.
Solution Approach 2:
The patent applies partial key management where only necessary keys are generated and maintained for each subscriber based on their specific subscription scope. Instead of managing all possible keys for all users, the system generates keys only when and where needed, reducing overall key management complexity while maintaining adequate security coverage for active subscriptions.
Data Source
AI summary
An encryption key management method includes: receiving a data registration request from a supplier terminal, determining a data identifier associated with the content data, encrypting a master key with a public key of the supplier terminal, and providing the supplier terminal with the master key encrypted with the public key of the supplier terminal, the data identifier, and a key update count value; receiving a subscription application related to the data identifier from a first subscriber terminal, encrypting the master key with a public key of the first subscriber terminal, and providing the first subscriber terminal with the master key encrypted with the public key of the first subscriber terminal and the key update count value; receiving encrypted content data encrypted with the symmetric key and a hash for the content data from the supplier terminal; and transmitting the encrypted content data and the hash to the first subscriber terminal.