Password Sharing via Token-Based Access and Server Key Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password sharing methods, such as PGP cryptography and password-encrypted zip files, face security challenges due to the need for significant effort and time in key management, susceptibility to password interception, and difficulty in changing shared passwords among multiple users.
Innovation Solution
A password sharing system utilizing identification tokens, password disclosure permission information, and multiple keys to securely share encrypted data by issuing identification tokens, verifying their correctness, and managing cipher keys for encryption and decryption based on user permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PGP cryptography is used for secure encryption, then security is improved, but time and effort required for key management increases significantly
Solution Approach 1:
The patent introduces a server as an intermediary that automatically manages public key distribution and password transmission. The server receives public keys from receivers, stores them, and automatically transmits encrypted passwords to the correct receiver without manual intervention, thereby maintaining security while reducing time and effort requirements
Solution Approach 2:
The system enables automatic self-service operations where the server autonomously handles key management tasks. The transmitter simply provides the receiver's public key and password, and the server automatically performs encryption, storage, and transmission of the password to the receiver without requiring manual key exchange or complex user actions
2Ease of operation
If a shared password is used for simplicity, then ease of operation is improved, but security deteriorates due to password sharing and lack of change capability
Solution Approach 1:
The patent segments the password management function by assigning unique passwords to individual files or data items rather than using a single shared password. Each file has its own encrypted password that can be independently managed, changed, or revoked without affecting other files, thereby maintaining ease of operation while significantly improving security
Solution Approach 2:
The system enables dynamic password management where passwords can be changed individually for each file or data item. The server facilitates password updates by transmitting new passwords to the correct receivers, allowing the system to adapt to changing security requirements without requiring all users to change all passwords simultaneously
3Reliability
If a random password is generated for each file transmission, then security is improved, but the risk of password interception increases because the password must be transmitted in a separate e-mail
Solution Approach 1:
The patent merges the password transmission function with the existing data transmission infrastructure. The server uses the same secure channel and encryption mechanisms already employed for file transfers to transmit passwords, eliminating the need for separate password e-mails and reducing exposure to interception risks
Solution Approach 2:
The server performs preliminary actions by pre-establishing secure communication channels and pre-encrypting data before transmission. The system prepares encrypted password containers and authentication mechanisms in advance, so that when password transmission is needed, the secure delivery path is already in place and does not require additional separate communication steps
4Device complexity
If manual password management is performed, then device complexity is reduced, but productivity decreases due to time-consuming key management processes
Solution Approach 1:
The server acts as an automated intermediary that handles the time-consuming tasks of password generation, encryption, storage, and distribution. This allows the system to maintain relatively simple client-side operations while achieving high productivity through server-side automation, effectively decoupling user simplicity from system complexity
Data Source
AI summary
After a pair of an identification token (131) and password disclosure permission information (134) transmitted from a first client terminal (102) is verified by a verification unit (106), a password registration unit (107) registers a record (122) including password information (133) and the password disclosure permission information (134) to a database 121 of a password sharing server (101) and transmits password identification information (135) for identifying the record to the first client terminal (102). The first client terminal (102) transmits data (139) including encrypted data (138) obtained by encrypting transmission data by using a cipher key (136) for data encryption after first processing output by a cipher key first processing unit (109), a cipher key (137) for data decryption after first processing output by the cipher key first processing unit (109), and the password identification information (135) obtained from the password registration unit (107), to a second client terminal (103). The second client terminal (103) makes an inquiry to a password disclosure unit (110) by using the password identification information (135) acquired from the received data (139) and an identification token (132) of the terminal itself. The password disclosure unit (110) acquires the pair of password information (133) and password disclosure permission information (134) corresponding to the password identification information (135), from the database (121), and notifies, when the identification token (132) is included in a password disclosure permissible range indicated by the password disclosure permission information (134), the second client terminal of the password information (133). The second client terminal (103) uses the notified password information (133) to generate a cipher key (140) for data decryption subjected to second processing from the cipher key (137) for data decryption after first processing acquired from the data (139) and uses the cipher key (140) for data decryption subjected to second processing to execute decryption on the encrypted data (138) in the data (139).