Object-Level Encryption Key Management via Customer Authentication Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption systems face challenges in managing and securely distributing encryption keys, authenticating users, and responding to unauthorized access attempts, particularly in multi-user and group scenarios, with limitations in condition-responsive access control and proactive security measures.
Innovation Solution
A customer authentication security server (CASS) manages encryption keys for both senders and receivers, using object-level encryption and a protocol that allows secure data transmission by generating a random symmetric session key, embedding a security policy, and enabling positive actions upon authentication failure, such as transmitting dummy data or spyware to track unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a Certificate Authority (CA) creates digital certificates to authenticate keys, then key authenticity is improved, but system complexity and administrative burden increase significantly
Solution Approach 1:
The patent extracts the key management functionality from the complex CA certificate system and implements it directly within the encryption/decryption devices themselves. Each device generates and manages its own cryptographic keys locally, eliminating the need for external CA infrastructure while maintaining authentication reliability through cryptographic proof of key ownership.
Solution Approach 2:
The system enables devices to autonomously generate, store, and manage their own cryptographic keys without requiring external CA intervention. The self-service key management approach allows devices to independently authenticate each other using their privately held keys, reducing administrative complexity while maintaining security.
2Adaptability or versatility
If encryption keys are distributed to multiple users, then data sharing capability is improved, but key management complexity and security risks increase
Solution Approach 1:
The patent segments the key management approach by assigning unique cryptographic key pairs to individual devices rather than distributing a single shared key. Each device independently manages its own private key and uses its public key for authentication, enabling multi-user data sharing without the complexity of managing multiple shared secrets or hierarchical key structures.
Solution Approach 2:
The system implements local key management where each device maintains its own cryptographic credentials locally. This allows each device to have different access rights and authentication credentials tailored to its specific needs, enabling fine-grained control over data sharing while simplifying overall key management compared to centralized approaches.
3Reliability
If traditional encryption systems are used, then basic data confidentiality is improved, but proactive security responses to unauthorized access attempts are not available
Solution Approach 1:
The patent implements feedback mechanisms where the encryption system actively monitors authentication attempts and provides real-time responses. When unauthorized access is detected, the system can immediately notify device owners, revoke access credentials, or alert security administrators, transforming passive encryption into an active security system that responds to threats as they occur.
Solution Approach 2:
The system performs preliminary security actions by pre-configuring authentication policies and access control rules before unauthorized access attempts occur. The system is prepared to immediately execute predefined security responses such as key revocation, access denial, or alert generation when authentication failures are detected, enabling proactive rather than reactive security management.
Data Source
AI summary
A symmetric PGP encrypted communications path is provided in which the recipient may be identified with only publicly available information. Data to be encrypted is encrypted at the object level. Encryption keys for both the transmitter and receiver are sent to a security server. Data received from the transmitter includes intended receiver ID. The receiver includes its actual ID. The received ID and the actual ID are sent to the security server for authentication. If authentication succeeds, the security server sends a session key to the receiver, and the receiver can use its own key to decrypt data. The system reacts to authentication failure by disabling decryption in the receiver and may also take countermeasures.