Folder Encryption via Server-Managed Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a growing need for enhanced security measures in devices to manage user data more securely, particularly in managing access to folders by authenticating users through a server to ensure the privacy and integrity of user data.
Innovation Solution
A system and method that involves a device transmitting an encryption key generation request to a server, receiving an encryption key associated with user authentication data, and using this key to encrypt or decrypt folders, with features like capturing images and transmitting location information in case of authentication failures, and updating encryption keys based on usage and expiration dates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If folder encryption is implemented using device-local keys, then encryption speed and accessibility are improved, but security is worsened because keys cannot be remotely revoked or updated
Solution Approach 1:
A server is introduced as an intermediary between the user and the encryption system. The server stores authentication data and issues encryption keys to the device. This mediator enables remote key management, allowing the server to revoke, update, or regenerate keys without requiring physical access to the device, thus resolving the security limitation of purely local encryption systems.
Solution Approach 2:
The system transitions from a single-dimension local encryption model to a multi-dimensional architecture involving device, server, and cloud storage. Encryption keys are generated and managed across multiple layers: authentication data on the server, encryption keys on the device, and encrypted folder metadata in cloud storage. This dimensional expansion enables both fast local access and secure remote management.
2Loss of time
If authentication data is stored locally in the device, then access speed is improved, but security is worsened because lost devices cannot be secured
Solution Approach 1:
The critical authentication data is extracted from the device and stored on the server. The device retains only temporary encryption keys needed for local operations, while the server holds the master authentication data. This extraction ensures that even if a device is lost, the attacker cannot obtain the authentication data, and the server can revoke access by controlling key issuance.
Solution Approach 2:
The system implements feedback mechanisms where the server monitors authentication attempts and can respond by updating or revoking keys. When authentication fails or a device is reported lost, the server receives feedback and takes corrective action by invalidating the corresponding encryption keys, thereby securing the data remotely without requiring physical device access.
3Reliability
If encryption keys are frequently updated, then security is improved, but device complexity and processing overhead are worsened
Solution Approach 1:
The server automates the key update process, eliminating the need for manual user intervention. When security updates are needed, the server automatically generates new encryption keys, transmits them to the device, and revokes old keys. This self-service approach allows frequent security updates without increasing user burden or operational complexity, as the system autonomously manages the key lifecycle.
Data Source
AI summary
Provided are a system and method of encrypting a folder in a device. The device for controlling access to the folder includes a communication part configured to transmit, to a server, an encryption key generation request with respect to the folder, and receive, from the server, an encryption key associated with the folder that is generated in response to the encryption key generation request, wherein the encryption key generation request includes an identification of the folder and authentication data of a user who accesses the folder is an authorized user; and a controller configured to authenticate the user by using the encryption key.