Hardware Key Management for Secure Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods expose encryption keys during processing, making them vulnerable to unauthorized access and decryption by malicious programs, leading to potential data breaches.
Innovation Solution
A data encryption and decryption system that uses a hardware-based approach, establishing SSL connections between a data encryption and decryption device, a cloud device, and a mobile device, generating and managing symmetric and public/private keys to securely encrypt and decrypt data, while performing authentication and key management processes to protect keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software encryption programs are used to encrypt data, then data can be encrypted and decrypted, but the allocated keys are exposed during processing making them vulnerable to unauthorized access
Solution Approach 1:
The patent introduces a dedicated key management module as an intermediary component that handles key generation, storage, and distribution separately from the main encryption/decryption operations. This mediator isolates keys from exposure during processing by providing a controlled interface for key usage without exposing the keys themselves in memory or logs.
Solution Approach 2:
The encryption system is divided into separate functional modules: a key management module that handles sensitive key operations, an encryption module that processes data, and a communication module that handles data transmission. This segmentation ensures that keys remain confined to the secure key management module and are never exposed in the data processing or transmission pathways.
2Ease of manufacture
If encryption keys are stored in software, then data encryption can be performed, but unauthorized persons and virus programs can access these keys to decrypt stored data
Solution Approach 1:
A secure key management module acts as an intermediary between the software layer and the keys, providing controlled access through authenticated interfaces. This mediator prevents direct software access to keys while allowing authorized operations through proper authentication channels.
Solution Approach 2:
The system implements pre-authentication mechanisms and access control policies before any key operations can occur. Fingerprint authentication and device binding are performed in advance to establish secure contexts, cushioning against unauthorized access attempts before they can reach the key storage layer.
3Productivity
If data is transmitted through network connections, then data can be communicated between devices, but network information theft increases rapidly
Solution Approach 1:
The patent introduces SSL/TLS protocol intermediaries for secure data transmission over networks. These protocol layers encrypt data in transit and provide authentication, acting as mediators that protect against network eavesdropping and theft while maintaining transmission efficiency through optimized cryptographic operations.
Solution Approach 2:
The system creates encrypted copies of data for network transmission while keeping the original plaintext data secured in the key management module. Only encrypted data copies are transmitted over the network, and decryption can only occur in the authenticated environment of the key management module.
4Reliability
If hardware-based encryption is implemented to protect keys, then key security is improved, but device complexity increases
Solution Approach 1:
The patent integrates the key management module as a unified security component that combines key generation, storage, authentication, and encryption/decryption operations in a single hardened module. This merging reduces overall system complexity compared to having separate components for each function, while maintaining high security through the integrated approach.
Solution Approach 2:
The key management module is designed as a universal security component that handles multiple functions: generating cryptographic keys, storing them securely, authenticating users through fingerprint biometrics, managing device bindings, and performing encryption/decryption operations. This multi-functionality eliminates the need for multiple separate security components, reducing device complexity while improving key protection.
Data Source
AI summary
A data encryption and decryption method is provided. The method is used in a data encryption and decryption system and includes: establishing, by a data encryption and decryption device, a first secure sockets layer (SSL) connection with a mobile device; receiving a data transmitted from the mobile device; generating a first symmetric key, encrypting the data using the first symmetric key, and generating first encrypted data; encrypting the first symmetric key using a first public key, and generating a first encrypted key; and transmitting the first encrypted data and the first encrypted key to the mobile device.