Multi-Context Authenticated Encryption Using Envelope Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption methods fail to securely decrypt data encrypted for multiple contexts due to lack of awareness of different encryption types used, leading to decryption failures when incorrect context information is provided.
Innovation Solution
Implementing an envelope-based encryption scheme where each envelope key is encrypted multiple times with relevant context information, allowing the decryption process to verify and use the appropriate context for successful decryption, using a master key and additional authenticated data (AAD) to manage and verify the encryption contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted for different types of resources or services using specific encryption algorithms, then data security and authenticity are improved, but the decryption process becomes complex and may fail when context information is not properly recognized
Solution Approach 1:
The patent segments the encryption system by introducing context-specific encryption algorithms for different resource types (container, block storage, file storage, etc.). Each resource type has its own encryption algorithm identified by a context value, allowing the decryption process to select the appropriate algorithm based on the resource context rather than using a single complex decryption mechanism for all types.
Solution Approach 2:
The patent introduces an intermediary mechanism (the context value and algorithm identifier) that bridges the encryption and decryption processes. The context value serves as a mediator that carries information about the resource type from the encryption phase to the decryption phase, enabling the decryption process to automatically select the correct algorithm without requiring complex manual configuration or analysis of the encrypted data structure.
2Reliability
If multiple encryption algorithms are used for different resource types, then data authenticity is improved, but the decryption process may be unaware of the different encryption used and fail to provide appropriate authenticated information
Solution Approach 1:
The patent applies preliminary action by embedding the context value and algorithm identifier in the encrypted data structure during the encryption phase. This pre-prepared information is stored alongside the encrypted data, so that when decryption is needed, the system can immediately retrieve and use the correct context information without requiring complex analysis or additional authentication steps during the decryption operation.
3Reliability
If context information is required for decryption, then data integrity is improved, but additional authentication mechanisms and complexity are introduced
Solution Approach 1:
The patent merges the context information and algorithm identification into a single integrated value that is stored with the encrypted data. Rather than requiring separate authentication mechanisms, additional metadata structures, or complex verification protocols, the context value combines multiple functions (resource type identification, algorithm selection, integrity verification) into one unified element that simplifies the overall authentication and decryption process.
Data Source
AI summary
Multi-context authenticated encryption can be used to secure various data objects, where a data object may be transmitted and/or stored using various types of resources. One or more envelope keys can be used to encrypt the body data, and each envelope key can be encrypted with a master key. The envelope keys are also be encrypted using at least a subset of context information available for the data object, as may correspond to one or more of the resource types. The encrypted data object can include at least one header, as well as the encrypted body data and the encrypted envelope key(s). In order to decrypt the data object, a data consumer would need the master key as well as at least a relevant subset of the context data.