Equity Incentive Data Encryption via Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data processing methods in equity incentive systems lack effective security measures, particularly in preventing data leakage and unauthorized access to sensitive information, as they rely on symmetric encryption schemes that can be compromised during transmission.
Innovation Solution
Implementing a method that uses different encryption schemes for different data types, where the first device encrypts data using a specific secret key and then encrypts the secret key itself, creating a data packet with both cipher texts and an encryption identifier, ensuring only authorized devices can decrypt and access the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric encryption scheme is used for data protection, then data can be encrypted and decrypted, but both secret key and cipher text may be leaked or the secret key may be intercepted during transmission
Solution Approach 1:
The patent segments the encryption process into two distinct stages: first encrypting the data with a data encryption key (DEK) to produce ciphertext, then encrypting the DEK itself with a key encryption key (KEK) to produce an encrypted key. This segmentation ensures that the DEK never leaves the client device in plaintext form, eliminating the risk of DEK interception during transmission while still allowing secure decryption at the server side.
Solution Approach 2:
The patent extracts the secret key (DEK) from the transmission channel entirely. Instead of transmitting the DEK along with the ciphertext, the system separates the data encryption function from the key transmission function. The DEK remains exclusively on the client device, and only the encrypted DEK (wrapped with KEK) is transmitted, effectively removing the vulnerability of plaintext key transmission.
2Reliability
If different encryption schemes are used for different data types, then data security is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal double-layer encryption framework that applies to all sensitive data types in the equity incentive system. Rather than implementing separate encryption schemes for different data types, the system uses a single standardized approach: encrypt data with DEK, then encrypt DEK with KEK. This universal mechanism simplifies system complexity while maintaining security consistency across all data types.
Solution Approach 2:
The patent changes the encryption parameters by introducing a hierarchical key structure with two distinct keys serving different purposes: DEK for data encryption and KEK for key encryption. This parameter change transforms the single-key symmetric encryption into a two-key hierarchical system, improving security without requiring different encryption schemes for different data types.
Data Source
AI summary
Provided are a method and an apparatus for data processing in an equity incentive system, which are applied in an equity incentive system, such as an Employee Stock Ownership Plan (ESOP) system. A first device obtains a mapping relation that includes a correspondence between at least one data type and at least one encryption scheme, determines a first encryption scheme corresponding to a data type of first data based on the mapping relation, generates a first data packet based on the first encryption scheme, and transmits the first data packet to a second device. In this way, the first device uses different encryption schemes based on different data types, and the second device obtains the first data by decryption based on an encryption identifier That is, according to the present disclosure, different encryption schemes are used for different data types, thereby improving data security without affecting normal use.