Key Service for Secure Cryptographic Data Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital rights management systems fail to secure data objects once they are shared externally and require technical sophistication, as they do not effectively control access or prevent unauthorized sharing, especially with symmetric key cryptography relying on password strength.
Innovation Solution
A method and system for distributing encrypted cryptographic data, where a key service manages public and private keys to control access, allowing a sender to encrypt data with a public key and ensure only authorized recipients can decrypt it using corresponding private keys, decoupling access control from data storage and distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric key cryptography is used to protect data objects, then password-protection functionality is provided, but authorized users can share the password with unauthorized users and security relies only on password strength
Solution Approach 1:
The patent segments the cryptographic key into multiple parts and distributes them to different authorized users. No single user possesses the complete key, making it impossible for any individual to independently decrypt or share the full cryptographic protection. This resolves the contradiction by maintaining strong security while preventing unauthorized sharing through architectural design rather than relying on user discipline.
Solution Approach 2:
The patent introduces a key service as an intermediary that manages and controls access to cryptographic keys. This mediator system handles key distribution, updates, and revocation, providing robust access control without requiring users to manually manage passwords. The intermediary enables fine-grained security policies while simplifying user operations.
2Reliability
If conventional digital rights management systems are used, then data objects are secured within the system, but the systems do not extend to securing data objects once shared with individuals external to the system
Solution Approach 1:
The patent creates a universal cryptographic key management system that functions both within the digital rights management ecosystem and for external data sharing. The key service and key splitting mechanism provide consistent security protection whether data is shared internally or externally, making the system adaptable to various sharing scenarios without requiring separate solutions.
Solution Approach 2:
The patent enables senders to independently control cryptographic key distribution without requiring intermediary approval for each sharing action. The system allows users to autonomously manage their own key splitting and distribution, facilitating external sharing while maintaining security. This self-service capability extends protection beyond traditional system boundaries.
3Reliability
If individuals implement cryptographic functions without a digital rights management system, then technical sophistication is required, but the average individual lacks the necessary technical knowledge
Solution Approach 1:
The patent introduces a key service as an intermediary that handles complex cryptographic operations on behalf of users. This mediator abstracts away the technical complexity of key management, splitting, and distribution, allowing average individuals to achieve strong cryptographic protection without needing to understand the underlying technical mechanisms.
Solution Approach 2:
The system provides automated cryptographic key management that users can access through simple interfaces. The key service automatically handles key generation, splitting, distribution, and revocation without requiring users to perform manual cryptographic operations. This self-service approach makes sophisticated cryptographic protection accessible to non-experts.
Data Source
AI summary
A method for distributing encrypted cryptographic data includes receiving, by a key service, from a first client device, a request for a first public key. The method includes transmitting, by the key service, to the first client device, the first public key. The method includes receiving, by the key service, from an access control management system, an encryption key encrypted with the first public key and a request from a second client device for access to the encryption key. The method includes decrypting, by the key service, the encrypted encryption key, with a private key corresponding to the first public key. The method includes encrypting, by the key service, the decrypted encryption key, with a second public key received from the second computing device. The method includes transmitting, by the key service, to the second client device, the encryption key encrypted with the second public key.