Portable Secure Data File Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data protection mechanisms, such as operating system restrictions, fail to ensure secure access to data when it is transferred to another computer, leading to loss of protection and potential unauthorized access.

Innovation Solution

A portable secure data file system that includes an encrypted data portion and a metadata portion, where the metadata stores access control policies, user permissions, and encryption keys, allowing secure access across devices while maintaining protection through symmetric and public key cryptography.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If operating system restrictions are used to protect data, then data access control is simplified and easy to implement, but data protection is lost when transferred to another computer

Engineering Contradiction:

Improvedata access controlVSAvoiddata protection

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The data file is segmented into two distinct portions: an encrypted data portion containing the actual data, and a metadata portion containing access control information. This segmentation allows the encrypted data to be portable across different computers while the metadata maintains access control policies, resolving the contradiction between ease of operation and reliability of protection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A metadata portion acts as an intermediary between the encrypted data and the access control system. The metadata contains service records and access control policies that enable portable protection without requiring the full operating system security infrastructure, allowing data to maintain protection when transferred between computers.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If data is encrypted using strong cryptography, then data security is improved, but computational overhead and processing time increase

Engineering Contradiction:

Improvedata securityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Encryption is performed in advance during file creation, and the encrypted data is stored in a portable format. The metadata portion is also prepared beforehand with access control information. This preliminary action eliminates the need for real-time encryption/decryption operations, reducing processing time during data access while maintaining strong security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The encryption keys and decryption capabilities are extracted and stored in the metadata portion rather than being embedded in the encrypted data itself. This allows for more efficient decryption operations during data access, as the keys are readily available in the portable metadata without requiring complex key management during processing.

Inventive Principle:

Principle #2Taking out (Extraction)

3Speed

If access control policies are stored locally on each computer, then access control is fast and responsive, but data protection is lost when transferred to another computer

Engineering Contradiction:

Improveaccess control responseVSAvoiddata protection portability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The access control policies are merged into the metadata portion of the portable data file, combining the benefits of local storage (fast access) with portability (protection across computers). The metadata travels with the encrypted data, ensuring that access control information is always available regardless of which computer the data is accessed from.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The metadata portion serves multiple functions: it stores access control policies, contains service records for remote services, and provides decryption information. This multi-functionality allows a single portable component to maintain access control across different computing environments, achieving both speed and reliability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Measurement precision

If metadata includes detailed access control information, then access control precision is improved, but file size and processing complexity increase

Engineering Contradiction:

Improveaccess control precisionVSAvoidfile structure complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The metadata portion contains detailed access control information specifically where needed, rather than distributing complexity throughout the entire file structure. The encrypted data portion remains simple and compact, while the metadata portion houses the detailed access control policies, service records, and decryption information, achieving precision without overall complexity.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8689015B2Portable secure data files

Publication Date: 2014.04.01 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A portable secure data file includes an encrypted data portion and a metadata portion. When a request associated with a current user of a device to access a portable secure data file is received, one or more records in the metadata portion are accessed to determine whether the current user is permitted to access the file data in the encrypted data portion. If a record indicates the user is permitted to access the file data, a content encryption key in that record is used to decrypt the encrypted data portion.