GUID Encryption at Storage Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-user network-based content management environments, managing and sharing content items becomes complex due to the reliance on content item paths and names in hierarchical directory structures, which limits sharing and storage efficiency.
Innovation Solution
Assigning Globally Unique Identifiers (GUIDs) to content items allows for unique identification and management, enabling richer functionality, sharing, and organizational structures independent of content item location, along with encryption for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If content items are identified using paths and names in hierarchical directory structures, then the system can maintain organized storage, but sharing between user accounts and storage efficiency are limited
Solution Approach 1:
The patent segments the content identification system into two independent parts: GUIDs for unique identification and paths for organizational context. This separation allows GUIDs to be freely shared across user accounts without carrying directory structure dependencies, while paths remain within their respective user hierarchies. The GUID serves as a portable identifier that can reference content regardless of its location in any user's directory structure.
Solution Approach 2:
The GUID acts as an intermediary between content items and user-specific directory structures. Instead of directly referencing paths that are tied to specific user hierarchies, the system uses GUIDs as intermediate identifiers that can be shared universally. This intermediary layer enables sharing by decoupling the identification mechanism from the organizational structure, allowing content to be referenced across different user contexts without exposing internal path dependencies.
2Ease of operation
If GUIDs are transmitted in communications between storage environment and client devices, then content identification is enabled, but unauthorized access and information leakage risks increase
Solution Approach 1:
The patent applies preliminary anti-action by encrypting GUIDs before they are transmitted in communications between the storage environment and client devices. This pre-emptive security measure ensures that even if communications are intercepted, the GUIDs remain protected and cannot be used for unauthorized access. The encryption is applied as a standard protective layer on all GUID-containing communications, preventing potential spoofing attacks and information leakage before they can occur.
Solution Approach 2:
The patent converts the potential harm of exposed GUIDs into a benefit by using encryption. The very act of encrypting GUIDs, which was introduced to prevent unauthorized access, also enables secure sharing mechanisms. The encrypted GUIDs can be safely transmitted and stored, allowing the system to implement sharing features without exposing the underlying identification structure to potential attackers. The security measure transforms what could be a vulnerability into a robust protection mechanism.
Data Source
AI summary
Systems, methods, and computer-readable storage media for encrypting communications containing or referencing globally unique identifiers to prevent unauthorized access to content item data, such as through spoofing or ancillary information leakage. An example system configured to practice the method identifies a communication, between a storage environment and a client device, associated with a globally unique identifier for a content item stored in at least one of the storage environment and the client device. The content item can be addressable via a globally unique identifier. Prior to transmitting the communication, the system can encrypt a portion of the communication containing the globally unique identifier using an encryption key based on a client-specific key and a secret version-specific key to yield an encrypted communication, and transmit the encrypted communication to the client device.