Position-Based Data Encryption for Multi-User Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems face challenges in efficiently managing access control and end-to-end encryption in multi-user environments, particularly in enterprise settings, where granting access to large numbers of users, performing resource-intensive operations, and ensuring data availability and security across user devices and servers is difficult.
Innovation Solution
A data encryption system with a server-based architecture that utilizes asymmetric user, position, and agent keys to manage encryption and decryption operations, allowing for centralized key management and resource-intensive tasks on high-performance servers, ensuring data security and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is performed using user-specific asymmetric keys for each user, then data security is improved, but the computational complexity and time required for key management increases significantly
Solution Approach 1:
The patent segments the key management system into multiple hierarchical levels: root keys at the top level, user-specific keys at the user level, and position-specific keys at the position level. This segmentation allows independent management of keys at different levels, reducing the overall complexity of key management while maintaining security. When a user needs access, only the specific position key needs to be generated and distributed, not all user keys.
Solution Approach 2:
The system performs preliminary actions by pre-generating and storing position keys on the server before users need access. When a user is assigned to a position, the position key is already available on the server and can be quickly transmitted to the user without requiring real-time key generation or complex cryptographic operations, thus reducing key management time.
2Reliability
If resource-intensive encryption and decryption operations are performed on user devices, then data security is maintained, but the processing speed and performance decrease
Solution Approach 1:
The patent introduces a server as an intermediary between users and the encryption/decryption process. The server performs resource-intensive operations such as generating position keys, encrypting position private keys with user public keys, and managing key distributions. This offloads computational burden from user devices while maintaining security through end-to-end encryption, thus improving processing speed without compromising data security.
3Reliability
If access control is implemented at the user level with individual encryption keys, then data security is improved, but the complexity of granting and revoking access rights increases
Solution Approach 1:
The patent segments access control from user-level to position-level abstraction. Instead of managing individual user permissions directly, the system creates position entities that aggregate access rights. Multiple users can be assigned to the same position and inherit the same access rights to documents. This segmentation simplifies access control management by reducing the number of individual permission settings needed while maintaining fine-grained security through position-specific encryption keys.
4Reliability
If asymmetric encryption is used for all data transmission and storage, then data security is improved, but the computational overhead and processing time increase
Solution Approach 1:
The patent merges symmetric and asymmetric encryption approaches in a hybrid system. Asymmetric encryption (using position keys) is used for key exchange and protecting sensitive key material, while symmetric encryption principles are applied for efficient data encryption once the symmetric key is established. This combination leverages the security benefits of asymmetric encryption for key management while using more efficient symmetric encryption for actual data protection, reducing computational overhead.
Data Source
AI summary
Data encryption system in multi-user environment and end-to-end data encryption comprising system server (1), user device (2), user-system network (3), system application (10) configured for creating, storing, searching, managing the access to data. System application (10) comprises client application (11), server application (12) and agent application (13). Data of the system comprises documents (19) and encryption and decryption keys. Keys are accessible to user (16) and agent application (13) only. Each document (19) is stored on system server (1) encrypted with document key (20). System application (10) defines a position (17), which is unit of company (15) and basic unit of system application (10), on whose behalf all actions with documents (19) are performed. User (16) is assignable to position (17), access of user (16) to document (19) is provided via assigned position (17) only. Each position (17) has unique pair of asymmetric position keys (21) generated by agent application.