File Encryption Key Segmentation for Secure Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods face challenges in managing and controlling symmetric keys, particularly in large-scale file encryption and decryption, where key sharing leads to security risks and scalability issues, and existing solutions either compromise security or are inefficient in bandwidth usage.
Innovation Solution
A novel encryption and decryption process that uses a file encryption key (FEK) generated locally and discarded after use, combined with a central encryption key (CEK) for secure file encryption and decryption, allowing for dynamic control of permissions and minimizing network bandwidth consumption by only transmitting portions of the encrypted file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If symmetric keys are shared among multiple clients for file decryption, then decryption capability is provided to authorized users, but security risks increase and key management complexity grows
Solution Approach 1:
The patent segments the encryption key management by introducing two distinct keys: a File Encryption Key (FEK) that is discarded after use, and a Central Encryption Key (CEK) that is retained and managed by the server. This segmentation allows multiple clients to decrypt files without sharing the same key, thereby maintaining security while enabling decryption capability across authorized users.
Solution Approach 2:
The patent introduces an intermediary key management mechanism where the server acts as a mediator between the FEK and multiple clients. The FEK is encrypted with the CEK and stored on the server, allowing authorized clients to retrieve and use the FEK for decryption without directly sharing keys with each other. This intermediary approach resolves the contradiction by enabling widespread decryption access while centralizing security control.
2Ease of operation
If symmetric keys are shared among multiple clients, then decryption is enabled for authorized users, but key management complexity increases
Solution Approach 1:
The patent segments key management responsibilities by dividing the key system into two parts: the FEK which is temporary and file-specific, and the CEK which is permanent and server-managed. This segmentation simplifies key management complexity by eliminating the need for the server to manage multiple unique keys for each client, while still enabling decryption capability for all authorized users through the intermediary encrypted FEK.
3Ease of operation
If entire encrypted files are transmitted over the network, then file decryption can be performed remotely, but network bandwidth consumption increases
Solution Approach 1:
The patent extracts only the essential decryption component (the FEK) from the encrypted file and transmits it separately over the network. The bulk of the encrypted file data remains local, and only the small FEK key material needs to be transmitted for remote decryption to occur. This extraction approach enables remote decryption capability while minimizing network bandwidth consumption by transmitting only the necessary key information rather than the entire file.
Data Source
AI summary
The disclosure includes novel encryption and/or decryption methods and systems that provide various security benefits. More specifically, the disclosure includes a description of a file encryption process and its ability to dynamically control permissions on who is allowed to decrypt the file. Moreover, the disclosed process permits an encrypted file to be freely distributed without losing the ability to govern/regulate decryption.