Encryption Key Management in Data Subscription Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data subscription systems, ensuring secure data sharing and integrity verification while facilitating frequent key generations, changes, and revocations is challenging due to the complexities of managing encryption keys across multiple providers and subscribers.
Innovation Solution
An encryption key management method that involves encrypting a master key with public keys of supplier and subscriber terminals, using a key update count value to derive symmetric keys, and managing key updates and revocations within the data subscription platform server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a typical PKI is used to prevent illegal sharing and verify data integrity, then data security and integrity are improved, but the system cannot meet the requirements for frequent key generations, changes, and revocations in a data subscription system with multiple providers and subscribers
Solution Approach 1:
The patent segments the key management system into a hierarchical structure with a root key and multiple derived keys (data subscription keys, data encryption keys, and data decryption keys). This segmentation allows independent management and revocation of specific keys without affecting the entire system, enabling flexible key updates while maintaining security.
Solution Approach 2:
The patent implements preliminary key derivation where child keys are pre-generated from parent keys using key derivation functions. This preliminary action enables rapid key generation and updates without requiring complex real-time computations, facilitating frequent key changes while maintaining security integrity.
2Ease of operation
If data is provided in plain text to enable easy access for subscribers, then ease of operation is improved, but the risk of data leakage to third parties increases
Solution Approach 1:
The patent introduces encryption as an intermediary mechanism between data providers and subscribers. Data is encrypted using data encryption keys before transmission, and decryption keys are provided to authorized subscribers. This intermediary encryption layer prevents direct data leakage while maintaining authorized access through proper key management.
3Adaptability or versatility
If frequent key generations and updates are implemented to accommodate new subscriptions and withdrawals, then adaptability is improved, but the complexity of key management increases
Solution Approach 1:
The patent segments keys into hierarchical levels (root key, data subscription keys, data encryption keys, data decryption keys) where lower-level keys can be independently updated. This segmentation reduces key management complexity by allowing targeted updates without propagating changes throughout the entire key hierarchy.
Solution Approach 2:
The patent implements a feedback mechanism where the server monitors subscription status changes and automatically triggers key updates when new subscriptions or withdrawals occur. This automated feedback loop reduces manual key management complexity while maintaining system adaptability to changing subscription conditions.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
An encryption key management method includes: receiving a data registration request from a supplier terminal, determining a data identifier associated with the content data, encrypting a master key with a public key of the supplier terminal, and providing the supplier terminal with the master key encrypted with the public key of the supplier terminal, the data identifier, and a key update count value; receiving a subscription application related to the data identifier from a first subscriber terminal, encrypting the master key with a public key of the first subscriber terminal, and providing the first subscriber terminal with the master key encrypted with the public key of the first subscriber terminal and the key update count value; receiving encrypted content data encrypted with the symmetric key and a hash for the content data from the supplier terminal; and transmitting the encrypted content data and the hash to the first subscriber terminal.