Hierarchical Keying Model for Dynamic Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic techniques for data security, such as symmetric-key encryption and one-way hash functions, face performance issues when managing access and integrity for large data objects, particularly in scenarios requiring frequent access modifications and revocation, leading to inefficiencies in read/write operations and key management.
Innovation Solution
The implementation of a method that allows efficient access control on a block or object basis using a hierarchical cryptographic keying model, where metadata is generated and utilized to manage access, enabling authorized entities to read, write, and modify access rights while ensuring data integrity and confidentiality by using per-block and per-object metadata to handle cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric-key encryption and one-way hash functions are used to protect data objects, then data confidentiality and integrity are improved, but performance and access control efficiency deteriorate
Solution Approach 1:
The data object is divided into multiple data blocks, each with its own cryptographic keys and metadata. This segmentation allows selective access to individual blocks rather than requiring decryption of the entire data object, improving access control efficiency while maintaining security.
Solution Approach 2:
A hierarchical key structure is introduced with multiple levels (data object key, data block keys, and cryptographic key pairs). This dimensional hierarchy enables granular access control where entities can be granted permission to specific blocks without obtaining access to the entire data object, resolving the contradiction between security and access efficiency.
2Reliability
If access rights are modified or revoked for entities, then security is improved by preventing unauthorized access, but performance deteriorates due to frequent re-keying operations
Solution Approach 1:
By segmenting the cryptographic keys into data object keys and data block keys, the system enables selective re-keying of only the affected blocks when access rights change. This avoids the need to re-key the entire data object, reducing the time loss associated with access modifications.
Solution Approach 2:
The hierarchical key structure is designed to be dynamic, allowing keys to be generated, revoked, and updated independently at different levels. When an entity's access is revoked, only the specific data block keys associated with that entity need to be updated, not the entire data object key hierarchy, making the re-keying process more efficient.
3Adaptability or versatility
If granular access control is implemented on data blocks, then access control flexibility is improved, but device complexity increases due to multiple keys and metadata management
Solution Approach 1:
The hierarchical key structure introduces dimensional organization to key management, with clear levels (data object key, data block keys, cryptographic key pairs). This dimensional arrangement, combined with structured metadata, makes the complexity manageable by providing a systematic framework for generating, storing, and revoking keys at different granularities.
Solution Approach 2:
Metadata acts as an intermediary layer that manages the relationships between entities, data blocks, and cryptographic keys. This intermediary structure simplifies key management by providing a centralized mechanism to track which entities have access to which blocks, reducing the overall system complexity despite the granular control capability.
Data Source
AI summary
Methods for cryptographic delegation and enforcement of dynamic access to stored data are disclosed. An example method includes generating for a first modified data block, a new per-block hash value using as a hash function input data contained in the first modified data block or a new per-block hash message authentication code (HMAC) using as hash function inputs a new per-block hash key and data contained in the first modified data block, writing the new per-block hash value or the new per-block HMAC to data block metadata associated with the modified data block in the protected data object, and writing the first modified data block to one of the data blocks of the protected data object.