Ephemeral Key Exchange for Sensitive Data Transmission Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data transmission systems fail to ensure the data security of sensitive data in the data to be transmitted during transmission, as existing data encryption methods do not effectively protect sensitive data in the data to be transmitted, and existing data encryption methods do not effectively protect sensitive data in the data to be transmitted during transmission, as existing data encryption methods do not effectively protect sensitive data in the data to be transmitted during transmission.
Innovation Solution
A data transmission method and apparatus that generates a first key based on a temporary private key generated by the client and a first public key generated by a target server, encrypts target data in the data to be transmitted, and sends target transmission data to the target server, which includes a temporary public key generated by the client corresponding to the temporary private key, the target encryption data, and other data in the data to be transmitted except the target data, ensuring that the target server can decrypt the target encryption data based on a second key generated from the temporary public key and the first private key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is encrypted using HTTPS with intermediate servers storing decryption keys, then data can be decrypted and processed by intermediate servers, but sensitive data security is compromised as intermediate servers can access plaintext data
Solution Approach 1:
The patent segments the encryption key into multiple parts distributed across different intermediate servers. No single server holds the complete decryption key, making it impossible for any individual server to decrypt the sensitive data independently. This resolves the contradiction by enabling data processing through distributed key segments while preventing unauthorized access to plaintext data.
Solution Approach 2:
The patent introduces a target server as an intermediary that coordinates the key aggregation process. The target server collects key segments from intermediate servers, combines them to form the complete decryption key, and then decrypts the sensitive data. This mediator approach allows intermediate servers to process data without directly possessing full decryption capabilities, thus maintaining security while enabling processing.
2Productivity
If intermediate servers store complete decryption keys to process data, then data processing is efficient, but the risk of data leakage increases
Solution Approach 1:
The decryption key is segmented into multiple parts stored across different intermediate servers. This segmentation maintains processing efficiency through distributed architecture while eliminating the data leakage risk associated with centralized key storage, as no single server contains the complete key.
Solution Approach 2:
The patent implements a nested structure where key segments are embedded within the distributed server system, and the complete key is nested within the target server's coordination process. This nested architecture enables efficient processing through the distributed system while protecting the complete key from exposure at any single level.
3Reliability
If encryption keys are distributed across multiple servers, then data security is improved, but key management complexity increases
Solution Approach 1:
The target server acts as an intermediary that simplifies key management complexity by centralizing the key aggregation and decryption coordination process. While keys are distributed for security, the target server manages the complexity of reassembling key segments and coordinating the decryption process, thus maintaining security without burdening individual intermediate servers with complex key management responsibilities.
Data Source
AI summary
The embodiments of the present disclosure provide a data transmission method and system, a computer device, and a storage medium, and the data transmission method includes: generating, in response to a data transmission instruction, a first key based on a temporary private key generated by the client and a first public key generated by a target server; encrypting target data in data to be transmitted to obtain target encryption data based on the first key; and sending target transmission data to the target server to cause the target server to generate a second key corresponding to the first key based on a temporary public key and a first private key corresponding to the first public key, and to decrypt the target encryption data based on the second key.