Hierarchical Encryption for Secure Data Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data synchronization solutions lack efficient encryption of data entities, particularly in metadata, leading to security vulnerabilities and performance issues with large datasets, and fail to provide secure read-only access sharing mechanisms.
Innovation Solution
The method encrypts data entities into three parts: data content, accompanying metadata, and synchronization metadata, using a hierarchical encryption approach with a synchronization key and group keys to enable secure synchronization and read-only access, while using message authentication codes for integrity checks and delete flags for data management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data entities are encrypted using symmetric encryption with entity keys protected by a master key, then data confidentiality is improved, but the entire data entity must be decrypted for synchronization metadata access, increasing processing time and security risk
Solution Approach 1:
The data entity is segmented into three distinct parts: data content, accompanying metadata, and synchronization metadata. Each part has its own encryption key (data key, data entity key, and synchronization entity key respectively). This segmentation allows the synchronization metadata to be decrypted and accessed independently without decrypting the entire data entity, thus reducing processing time while maintaining confidentiality.
Solution Approach 2:
Different parts of the data entity have different security requirements and access patterns. The invention applies different encryption keys to different parts: the synchronization metadata uses a dedicated synchronization entity key that can be independently decrypted, while the data content uses a separate data key. This local differentiation of security properties allows efficient synchronization operations without compromising overall data confidentiality.
2Device complexity
If a single managing data entity stores all synchronization metadata, then synchronization management is simplified, but the managing entity grows large and becomes a critical point for disruption
Solution Approach 1:
Instead of using a single managing data entity to store all synchronization metadata, the invention segments the metadata into individual synchronization metadata entities associated with each data entity. This segmentation distributes the metadata storage across multiple smaller entities, eliminating the single point of failure and reducing the impact of any single metadata corruption or loss.
3Reliability
If encryption is applied to protect data, then data security is improved, but the ability to share data with read-only access control is limited
Solution Approach 1:
The invention applies different access controls to different parts of the data entity. The synchronization metadata can be accessed and modified by authorized users for synchronization purposes, while the data content remains protected with read-only access control. This local differentiation of access properties enables flexible sharing scenarios where users can perform synchronization operations without being able to modify the actual data content.
Data Source
AI summary
A method for encrypted data synchronization, wherein the method includes providing at least one data entity (100) including data content (110), accompanying metadata (120) including an entity key (140) usable for encrypting the data content (110), and synchronization metadata (130) usable for synchronizing the at least one data entity (100) between at least two first devices (400), wherein at least the entity key (140) of the accompanying metadata (120) and the synchronization metadata (130) are encrypted using a second key.