Network Device Key Segmentation for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems for network devices are inadequate in ensuring secure encryption and decryption of sensitive data, as they lack robust key management and authentication mechanisms, making them vulnerable to unauthorized access.
Innovation Solution
A network device generates different keys, including a secret key, a client key, and a server key, which form the secret key when combined, and uses these keys to encrypt data. It creates a URL with the client key and a randomly-generated data identifier, sending it to the recipient for authentication, allowing the recipient to request the data while discarding the secret key, ensuring only authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single secret key is used for encrypting data, then encryption is simple and fast, but the system becomes vulnerable to unauthorized access if the key is compromised
Solution Approach 1:
The patent divides a single secret key into multiple segments (first key segment, second key segment, third key segment) that are stored separately in different locations or by different users. These segments are combined only when needed for decryption, ensuring that no single point of failure exists. This segmentation resolves the contradiction by maintaining security through distribution while enabling functional decryption when all segments are properly assembled.
Solution Approach 2:
The patent implements a hierarchical key structure where master keys, intermediate keys, and data encryption keys are nested within each other. Each layer of encryption contains or protects the next layer, creating a nested security architecture. This nested structure allows simple decryption at the data level while maintaining complex security at higher levels, resolving the contradiction between simplicity and security.
2Reliability
If encryption keys are stored securely, then data security is improved, but access to decrypted data becomes difficult
Solution Approach 1:
The patent pre-distributes key segments to authorized users or locations before data decryption is needed. These segments are prepared and secured in advance, so when decryption is required, all that is needed is the assembly of pre-positioned segments rather than complex real-time key generation. This preliminary preparation maintains security while enabling easy access when authorized.
Solution Approach 2:
The patent introduces key management servers or trusted intermediaries that facilitate the combination of key segments without exposing the segments themselves. These intermediaries mediate between secure key storage and data decryption, allowing authorized access while maintaining security. The intermediary handles the complex key assembly process, making data access easy for authorized users while preserving security architecture.
3Reliability
If key segments are distributed to multiple locations, then security against single-point failure is improved, but coordination for key assembly becomes complex
Solution Approach 1:
The patent implements feedback mechanisms where key management systems continuously monitor the status, location, and integrity of distributed key segments. This feedback allows the system to automatically coordinate key assembly, track which segments are available, and manage the combination process. The feedback loop simplifies coordination by providing real-time information about key segment status, reducing the complexity of managing distributed segments.
Solution Approach 2:
The patent creates universal key management protocols and standardized interfaces that work across different locations, systems, and users. These universal mechanisms allow diverse key segments from different sources to be coordinated and assembled through common procedures. The multi-functional key management system handles distribution, storage, retrieval, and assembly across multiple locations using standardized processes, reducing coordination complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A network device for maintaining data security generates different keys corresponding to data received from a sender. The different keys comprise a secret key, a client key, and a server key. The client and server keys form the secret key when combined. The network device encrypts the data with the secret key and discards the secret key in response. The network device generates a Uniform Resource Locator (URL) for requesting the data from the network device. The URL comprises the client key and a randomly-generated data identifier associated with the data. The network device sends the URL to an electronic address of a recipient and discards the client key in response.