Key Generator for Overlapping Data Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access systems face inefficiencies, such as the need for re-encryption when access rights are revoked or keys are lost, and require decryption capabilities on user equipment, which adds overhead and security risks.
Innovation Solution
A system using a key generator to create overlapping sets of data portions and associated keys, with one-way functions to ensure secure access control, allowing only authorized parties to access specific data portions without re-encrypting the entire dataset and eliminating the need for decryption on user equipment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If portion specific keys are used to encrypt data portions, then access control to specific data portions is improved, but re-encryption of all data portions is required when a key is lost or access rights are revoked
Solution Approach 1:
The data is divided into portions, each encrypted with a portion-specific key. When access rights need to be revoked or a key is lost, only the affected portion(s) need to be re-encrypted, not the entire dataset. This segmentation approach minimizes the impact scope and reduces re-encryption time significantly.
Solution Approach 2:
Different portions of the data have different access control requirements and are encrypted with different keys. This allows selective re-encryption of only those portions that require updated access control, rather than re-encrypting the whole dataset, thereby reducing time loss while maintaining reliable access control.
2Reliability
If portion specific keys are used for data access, then access control is improved, but decryption capability must be implemented on user equipment adding overhead
Solution Approach 1:
A key distribution server acts as an intermediary between the data storage system and user equipment. The server manages the portion-specific keys and provides them to authorized users when needed. This eliminates the need for users to have built-in decryption capabilities, reducing device complexity while maintaining secure access control.
Solution Approach 2:
The key distribution server automatically provides the necessary keys to authorized users without requiring them to manage decryption capabilities. The system handles key distribution and access control autonomously, simplifying the user equipment requirements while maintaining reliable access control.
3Reliability
If all data portions are re-encrypted when access rights change, then access control security is improved, but system overhead and processing time increase
Solution Approach 1:
The data is segmented into portions with individual keys. When access rights change, only the affected portions are re-encrypted, not the entire dataset. This segmentation approach maintains security by re-encrypting only necessary portions while minimizing system overhead and processing time.
Solution Approach 2:
Instead of re-encrypting all data portions when access rights change (excessive action), the system re-encrypts only the affected portions (partial action). This partial approach maintains adequate security while significantly improving system processing speed and reducing overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, apparatus and computer programs for enabling access to data by a requesting party. A plurality of sets of data are generated. A one one-way function is then used to generate a plurality of keys each associated with a respective one of the plurality of sets. Information associated with the data in a given set is used as an input to the one-way function when generating the key for that set. The keys are distributed to requesting parties. Subsequently, a requesting party may make a data access request using the received key. Upon receipt of a key, access may be enabled to the data. The requesting party may then generate validation data from information associated with at least a part of the received data and validating the received data by comparing the validation data to data derived from the received key.