Multi-Key Encryption for Granular Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data systems often fail to provide adequate access control by either completely denying or fully granting access to users, lacking the ability to allow partial access based on varying levels of detail or resolution.
Innovation Solution
A multi-key encryption system that divides plaintext into portions based on predefined sizes and locations, encrypting each portion with a key corresponding to its level of detail and access level, allowing selective access while maintaining format-preserving encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is encrypted with a single key to ensure security, then access control is simplified, but the ability to provide partial access based on user roles is lost
Solution Approach 1:
The patent divides the original data into multiple portions and encrypts each portion with a different key corresponding to different access levels. This segmentation allows the system to provide partial access to different users based on their authorization level, resolving the contradiction between security and access control flexibility.
Solution Approach 2:
Different portions of the data are assigned different encryption keys based on their sensitivity and access requirements. This local differentiation enables fine-grained access control where specific portions can be accessed by specific user roles, while maintaining overall system security.
2Adaptability or versatility
If data is divided into portions and encrypted with multiple keys to enable partial access, then access control flexibility is improved, but system complexity increases
Solution Approach 1:
The system pre-divides the data into portions and assigns different encryption keys to each portion before actual access occurs. This preliminary organization enables efficient partial access without requiring complex real-time decryption decisions, reducing operational complexity.
Solution Approach 2:
The encryption system is designed to work with multiple keys simultaneously, where each key serves a specific access level. This multi-functional approach allows the same encrypted data structure to serve multiple access requirements without requiring separate encryption systems for different user roles.
3Adaptability or versatility
If format-preserving encryption is used to maintain system compatibility, then system redesign is avoided, but the ability to enforce access control on encrypted data is limited
Solution Approach 1:
The patent segments the encrypted data into multiple portions, each encrypted with a different key. This segmentation maintains the format-preserving property (allowing system compatibility) while enabling differential access control, as each portion can be independently accessed or denied based on user authorization.
Data Source
AI summary
Examples discussed herein disclose, among other things, an encrypting device. The encrypting device may include a key engine to obtain a first key associated with a first access level, and a second key associated with a second access level. The encrypting device may also include a multi-key encryption engine to encrypt a first portion of the plaintext with the first key, and encrypt a second portion of the plaintext with the second key, where the first portion may include more detailed information than the second portion, and where the first access level may be higher than the second access level.