File Security via Shredded Encryption Across Distributed Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file security methods, such as encrypting entire files and using data storage redundancy, fail to effectively protect against unauthorized access and decryption, especially when files are stored across various devices and cloud storage.
Innovation Solution
A system that breaks files into parts, encrypts each part separately, and stores them across local, network, removable, and cloud storage locations, requiring access to a sentinel for decryption and reconstruction, enhancing security and recoverability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If entire files are encrypted using traditional API methods, then file security is provided, but if encryption is overcome, the attacker gains access to the full file
Solution Approach 1:
The patent divides a file into multiple independent parts (shreds) and encrypts each part separately with different encryption keys. This segmentation ensures that if one encrypted part is compromised, the attacker cannot reconstruct the entire file without all parts and their corresponding keys, thereby enhancing security while managing complexity through modular organization
2Reliability
If data storage redundancy (RAID) is used to protect against hardware failure, then file recoverability is improved, but it provides no protection against unauthorized file access
Solution Approach 1:
The patent combines segmentation with redundancy by creating multiple shreds of the file and distributing them across different storage locations with RAID protection. Each shred is encrypted separately, so even if redundancy recovers data from failed storage, the segmented and encrypted structure prevents unauthorized reconstruction without all required shreds and their keys
Solution Approach 2:
The patent merges RAID redundancy with file segmentation and encryption to create a hybrid system that provides both fault tolerance and security. The combination allows the system to recover from hardware failures while maintaining protection against unauthorized access through the segmented encrypted structure
3Object-affected harmful factors
If files are broken into parts and stored in multiple locations, then security against unauthorized access is improved, but device complexity and access management become more complex
Solution Approach 1:
The patent introduces a file server as an intermediary that manages the segmented encrypted files. The file server coordinates access to multiple shreds stored across different locations, handling the complexity of reassembly and decryption coordination, thereby simplifying client access while maintaining security through the segmented structure
4Object-affected harmful factors
If sentinels are required for decryption and access, then security against unauthorized decryption is enhanced, but ease of operation decreases
Solution Approach 1:
The file server acts as an intermediary that manages sentinel verification and decryption operations. Users interact with the file server through simplified interfaces while the server handles the complex sentinel validation and coordinated decryption of multiple encrypted shreds, thereby maintaining strong security while improving ease of operation
Data Source
AI summary
Storage end points, whether they are local, remote, network, or cloud, such as DROPBOX and APPLE, present security issues for the general public and corporate consumers. These storage end points are not always encrypted. Even when the end user does perform encryption, the drawback to normal implementations is that the entirety of the file, the file key, and the key store are encrypted and stored in a single location. Computers can be hacked and encryption can be broken when given access and time. Disclosed is a system and method that enhances file level security by shredding the file, file pointers, and key store into parts, allowing the parts to be stored in different storage end points specified by the user.