Portal Server Re-Encryption for Time-Limited Agent Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In information service systems, existing encryption methods face challenges in securely managing agent authority, particularly in allowing agents to browse user-specific information only during specified time periods while minimizing the number of keys that need to be managed, as conventional solutions lead to complex key management and potential information leakage.
Innovation Solution
The system employs a method where requested information is encrypted by an information providing server and transmitted through an information relay device, with re-encryption keys used to allow agents to access encrypted data only during specified time periods, stored in separate memory units and managed using time keys to control access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption methods (AES) are used between information provider and user, then data security is improved, but key management complexity increases significantly when agent service is implemented
Solution Approach 1:
The patent introduces a portal server as an intermediary that holds re-encryption keys. The information provider encrypts data with the user's public key, and the portal server re-encrypts it with the agent's public key using its re-encryption key. This mediator approach allows secure agent access without requiring the information provider to directly manage agent keys, thus improving data security while reducing key management complexity for the information provider.
Solution Approach 2:
The patent segments the encryption process into multiple stages: first encryption by the information provider using the user's public key, then re-encryption by the portal server using the re-encryption key and the agent's public key. This segmentation allows different entities to manage different keys, reducing the overall key management burden on any single party while maintaining security.
2Ease of operation
If agent authority is granted for all time periods, then ease of operation is improved, but information security deteriorates due to unlimited access
Solution Approach 1:
The patent implements dynamic time-limited access by incorporating valid time periods into the encryption process. The portal server includes the valid time period in the re-encrypted data, and the agent terminal verifies this time period before decryption. This dynamic approach allows agent authority to be easily granted and revoked within specific time frames, improving ease of operation while maintaining information security through automatic expiration.
3Reliability
If encryption keys are updated for each time period to limit agent access, then information security is improved, but key management complexity increases enormously
Solution Approach 1:
The patent makes the portal server's re-encryption key multi-functional by designing it to work across multiple time periods. Instead of creating separate encryption keys for each time period, the single re-encryption key on the portal server can handle re-encryption for any time period by incorporating the time period information into the re-encrypted data. This universal approach improves information security through time limiting while avoiding the enormous key management complexity that would result from per-time-period key updates.
Data Source
AI summary
With a portal server, a request for information from a terminal of a second user that is an agent for a first user is received, and an encrypted data directed to a terminal of the first user, stored in an encrypted-data memory unit, is re-encrypted using a re-encryption key for the second user, stored in a first encryption-key memory unit, and is transmitted to the terminal of the second user, with the terminal of the second user, the re-encrypted data received is decrypted using an encryption key for the second user, stored in a second encryption-key memory unit, and time keys specified by the terminal of the first user, related to a time-period during which browsing of the information is permitted.