Identity-Based Encryption for Composite Document Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control technologies for composite documents with multiple parts and formats struggle to provide fine-grained access control across dispersed participants without a trusted third party, leading to security challenges in collaborative workflows involving sensitive data.
Innovation Solution
The implementation of Identity-Based Encryption (IBE) eliminates the need for prior possession of public and private keys by calculating them based on user identities, allowing for delayed private key generation and enforcement of workflow order, enabling secure access control and management of composite documents across organizational boundaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control technologies are used for composite documents, then basic security can be provided, but fine-grained access control across dispersed participants cannot be achieved without a trusted third party
Solution Approach 1:
The patent extracts the trusted third party (certificate authority) from the system by using identity-based encryption. Each participant's identity (email address, username, or other unique identifier) directly serves as their public key, eliminating the need for external key management infrastructure. This allows fine-grained access control to be implemented without requiring a centralized trusted authority, thereby reducing system complexity while maintaining security reliability.
Solution Approach 2:
The system enables participants to self-generate their cryptographic key pairs using their own identities. Each user can independently derive their public key from their identity and obtain their private key through secure key generation processes without requiring enrollment with a certificate authority. This self-service capability reduces the need for complex centralized management while maintaining secure access control.
2Reliability
If public and private keys are required to be possessed prior to workflow, then security can be established, but delayed private key generation and workflow order enforcement become impossible
Solution Approach 1:
The patent implements preliminary action by pre-defining the workflow order and access permissions in the encrypted composite document structure. The document master can specify which participants need access to which parts of the document and in what sequence, without requiring participants to have their private keys ready beforehand. The key generation and distribution is triggered automatically when needed during the workflow execution, enabling both security and flexibility.
Solution Approach 2:
The system dynamically generates and distributes private keys to participants based on their position in the workflow and the current state of document processing. Rather than requiring static pre-provisioning of keys, the system adapts key distribution to the actual workflow needs, allowing participants to receive keys only when they need to access the document, thereby enabling both security and workflow flexibility.
3Adaptability or versatility
If fine-grained access control is implemented across organizational boundaries, then secure collaborative workflows can be enabled, but the risk of data breaches increases without proper encryption
Solution Approach 1:
The patent applies local quality by encrypting different parts of the composite document with different cryptographic keys corresponding to different participants' identities. Each participant can only decrypt and access the specific portions of the document for which they have been granted permission, while other portions remain encrypted. This fine-grained, location-specific encryption approach enables secure cross-organizational collaboration by ensuring that each participant accesses only the data they are authorized to view, thereby reducing data breach risk while maintaining workflow versatility.
Data Source
AI summary
A workflow order is created for the object. Public parameters are received from a key generation center at a computer associated with an object master. A public key is generated at the computer system based on a user identifier and the public parameters, wherein the user identifier is comprised of user related information. The object is encrypted using the public key such that the object cannot be opened without the a private key, wherein the object is a composite document comprising multiple elements of documents of different formats, and wherein the private key is generated in response to a request from an authenticated user using the user identifier at the key generation center. Access to the multiple elements of the object is controlled based on workflow order.