Layered Document Access Control via Selective Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital rights management systems encrypt documents at the file level, allowing all contents to be accessible if a user is granted access, leading to increased storage demands and security risks if access credentials are compromised, as multiple encrypted versions of documents are required to grant different users access to different contents.
Innovation Solution
Implementing a digital rights management method that allows different users to access different contents of a document by defining document layers with specific access permissions, using layer-level access control and encryption keys, enabling selective decryption and display of document content based on user permissions, without creating multiple separate files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If document-level encryption is used to protect digital documents, then security is improved, but all contents become accessible if a user is granted access, worsening the security control over individual contents
Solution Approach 1:
The patent segments the document into multiple layers (e.g., background layer, foreground layer, annotation layer), each with independent encryption keys and access control policies. This allows selective access to different document contents while maintaining overall document security, resolving the contradiction between document-level protection and fine-grained content control.
Solution Approach 2:
Different layers of the document are assigned different security attributes and access rights. For example, the background layer may be accessible to all users while the annotation layer requires special permissions. This local differentiation enables selective content access control without compromising overall document security.
2Ease of operation
If multiple encrypted versions of documents are created to grant different users access to different contents, then selective access control is improved, but system storage demand increases, worsening storage efficiency
Solution Approach 1:
The patent merges multiple encrypted versions into a single multi-layered document structure. Different layers are encrypted with different keys but stored together in one file, eliminating the need for separate encrypted copies while maintaining selective access control capabilities.
Solution Approach 2:
The single multi-layered document structure serves multiple functions: it provides different access levels to different users, maintains security, and reduces storage requirements. This universal structure replaces the need for multiple specialized encrypted files.
3Ease of manufacture
If document-level encryption is used, then implementation simplicity is improved, but security control granularity deteriorates, as all contents are exposed if access credentials are leaked
Solution Approach 1:
The patent segments the document into multiple layers with independent encryption keys, maintaining implementation simplicity through a unified multi-layer structure while achieving fine-grained security control. Each layer can be independently protected, preventing total exposure if one layer's credentials are compromised.
Solution Approach 2:
The patent implements a nested encryption structure where layers are encrypted within layers. The background layer may contain encrypted annotation layers, which in turn may contain further encrypted content. This nested approach provides granular security control while maintaining a manageable implementation structure.
Data Source
AI summary
In a digital rights management system, layers are defined for each document and user permissions are specified for each layer, to control user access at the layer-level. The layers are ordered by depth, where a layer completely contained inside another layer is deemed deeper than the other layer. The layers are encrypted in a deep-to-shallow order, each by its own encryption key. The entire document is then encrypted. When a user requests access to a document, the system generates an ordered sequence of encryption keys based on the user's access rights for each layer. The document open program on the user's client computer attempts to decrypt the various layers using the ordered sequence of keys. The client program and the system's key sequence generating algorithm are designed to give the result that only layers that the user has access to are successfully decrypted and displayed at document open time.