Nested Key Encryption for Secure Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer systems face security challenges in data sharing due to the need for direct access to encryption keys, which compromises security and privacy, and existing solutions either require expensive key management or decrypt data, compromising security.
Innovation Solution
A key encryption mechanism that achieves a 'trust-no-one' architecture by using a 3-tier structure (Record, RecordSet, and Entity) without a centralized key store, allowing encrypted data sharing without decryption, with access control managed through encrypted keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are stored directly in the database for data sharing, then data sharing is enabled, but security is compromised due to direct access to keys
Solution Approach 1:
The patent introduces an intermediary key wrapping mechanism where record keys are encrypted and stored alongside data. This intermediary layer prevents direct access to plaintext keys while enabling authorized decryption, resolving the contradiction between ease of data sharing and security protection.
Solution Approach 2:
The patent implements nested encryption where record keys are wrapped within encrypted containers stored in the database. The keys are not stored plainly but nested within encrypted structures, allowing access only through proper decryption protocols, thus maintaining both shareability and security.
2Device complexity
If a centralized key store is used to manage encryption keys, then key management is simplified, but trust requirements increase and security is reduced
Solution Approach 1:
The patent extracts the key management function from a centralized authority and distributes it to individual records. Each record carries its own encrypted key, eliminating the need for a centralized key store and enabling trust-no-one architecture while maintaining manageable complexity through automated key wrapping operations.
Solution Approach 2:
The system enables self-service key management where records manage their own encryption keys independently. The key wrapping mechanism automatically encrypts and stores keys with records, allowing the system to manage itself without centralized intervention, thus achieving both simplicity and trust-no-one architecture.
3Ease of operation
If individual records are decrypted before sharing or regrouping, then data can be shared, but processing time and computational overhead increase
Solution Approach 1:
The patent applies preliminary key wrapping during data storage, where record keys are encrypted and stored alongside the data. This preliminary action enables future sharing and regrouping operations to proceed without time-consuming decryption, as the key structure is already prepared for authorized access.
Solution Approach 2:
The patent segments the encryption mechanism into independent record-level key wrapping operations rather than requiring decryption of entire records. This segmentation allows selective access and sharing of individual records without processing the entire dataset, reducing computational overhead and time loss.
4Ease of operation
If encryption keys are shared to enable data access, then data can be accessed by recipients, but key management overhead and security risks increase
Solution Approach 1:
The patent uses the encrypted record key as an intermediary that mediates between data owners and recipients. Instead of sharing keys directly, the system shares encrypted records with wrapped keys, allowing access without key management overhead while maintaining security through the intermediary encryption layer.
Solution Approach 2:
The key wrapping mechanism serves multiple functions simultaneously: it encrypts keys for storage, enables selective access control, and facilitates sharing without key distribution. This multi-functionality reduces key management overhead by consolidating multiple security operations into a single unified mechanism.
Data Source
AI summary
A method for sharing encrypted data and encryption keys through a system comprised of the following data types, but not limited to a; 1) Record and its encryption key, 2) RecordSet and its encryption key, and 3) Entity and its encryption key. A Record is encrypted using an encryption key, furthermore, the Record encryption key is encrypted using a RecordSet encryption key, and finally, both the encrypted Record and its encrypted encryption key are wrapped as a single unit, to avoid key the expensive operations of key lookup and general key operation overhead. Access control to the RecordSet encryption keys are provided by a combination of data types, but not limited to a; 1) Entity and its encryption key, 2) Ciphers, and 3) Trusted Entity Lists. For each Entity which is authorized access to access a RecordSet, an encrypted Cipher, made of both the Entity encryption key and RecordSet encryption key, is added to a Trusted Entity List. Tokens are protected by user defined secrets, comprised of Entity encryption keys.