Distributed Ledger Key Management for Secure Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing systems face vulnerabilities due to external hacking and misuse, and manual key provisioning processes are cumbersome and time-consuming, leading to inefficiencies in secure data exchange and access management.
Innovation Solution
A distributed key management system using distributed ledger technology (DLT) separates encryption and decryption keys, stores them on a blockchain for immutability, and utilizes smart contracts for run-time access control, ensuring secure and efficient data sharing among entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual key provisioning is used, then security control is maintained, but the process becomes cumbersome and time-consuming
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing public keys on the blockchain before they are needed for data encryption. This eliminates the need for manual key provisioning at the time of data sharing, as keys are already available for immediate use while maintaining security through cryptographic principles.
Solution Approach 2:
The blockchain acts as an intermediary between key management and data sharing processes. It provides a decentralized, immutable ledger that automatically manages key distribution and access control, replacing manual key provisioning processes while maintaining security through smart contracts and cryptographic verification.
2Productivity
If encryption keys are shared for data access, then data sharing is enabled, but vulnerability to hacking and misuse increases
Solution Approach 1:
The system segments the encryption key into two parts: the public key stored on the blockchain for encryption, and the private key kept secure by the data owner for decryption. This segmentation enables data sharing through public key encryption while the private key remains protected, eliminating the need to share the full encryption key and thus reducing security vulnerabilities.
Solution Approach 2:
The system employs asymmetric cryptography where the public key and private key have different functions and security requirements. The public key can be freely shared for encryption, while the private key remains confidential for decryption. This asymmetry enables efficient data sharing without compromising security, as the shared public key cannot be used to derive the private key.
3Productivity
If blanket permissions are granted via service contracts, then data processing is enabled, but vulnerabilities on sensitive data assets are created
Solution Approach 1:
The system implements dynamic access control where permissions are not static but can be modified in real-time. Smart contracts on the blockchain enable the data owner to grant, revoke, or modify access permissions at any time based on changing business requirements, allowing data processing to continue while maintaining flexible security control.
Solution Approach 2:
The blockchain provides a transparent, immutable record of all key access and data sharing transactions. This creates a feedback mechanism where all parties can verify who has accessed what data and when, enabling auditability and accountability. The feedback loop allows for real-time monitoring and immediate revocation of permissions if security concerns arise.
Data Source
AI summary
The present disclosure is directed to systems and methods for securely managing and administering an encryption/decryption key using distributed ledger technology (DLT). In some examples, a client may possess a data attribute (or a dataset of data attributes). The client may receive tokenization parameters to apply to the data attribute to encrypt the data attribute. After tokenizing the data attribute, the client may then request the creation of an encryption key to be applied to the token. A third-party key management system (KMS) may create an encryption key and a salt. The salt may be applied to the token, and the salted token may then be encrypted. Additionally, a decryption key may be created and stored securely at the third-party KMS. The client may transmit the encrypted token to a third-party consolidation platform, wherein the consolidation platform requests access to the decryption key to unveil the underlying token.