File Sharing Key Manager Credential Segmentation

The patent segments the key management system into two distinct components: file-level encryption keys (which encrypt the actual file data) and access credentials (which contain user-specific decryption information). This segmentation allows the file to be encrypted once with a single file key, while multiple users receive different credential segments that reference this key, thereby maintaining security without requiring N×F unique key pairs.

The patent introduces credentials as an intermediary data structure that mediates between the file encryption key and user private keys. The credential contains the file key identifier and the user's public key, serving as a reference that connects users to the encrypted file without storing redundant encryption data. This intermediary mechanism resolves the contradiction by enabling secure access control with minimal storage overhead.

The patent replaces the traditional Access Control List (mechanical system of permission tables) with a cryptographic system based on asymmetric encryption and digital signatures. Instead of managing access rights through administrative lists that are vulnerable to tampering, the system uses mathematically secure key pairs and credential verification. User B's access to User A's file is secured through cryptographic proof rather than trust-based permission lists, eliminating security vulnerabilities while maintaining ease of operation.

The patent uses digital signatures as cryptographic copies that verify authenticity without duplicating the original secret information. When User A signs the credential with their private key, it creates a verifiable copy that proves authorization. This cryptographic copying mechanism provides security equivalent to or better than traditional ACLs while maintaining operational simplicity.