Private Data Sharing System With Client-Side Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data sharing systems lack adequate security and privacy measures, allowing unauthorized access to sensitive user data, which compromises both real and perceived privacy and security.
Innovation Solution
A private data sharing system that encrypts user data and stores it in an obfuscated form, with decryption keys held solely by users and their designated contacts, ensuring only authorized individuals can access and decrypt the data, and employs a method for secure key exchange and storage to prevent access by the system operators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in plain text format for easy access, then ease of operation is improved, but security and privacy are compromised
Solution Approach 1:
The system segments data access rights by creating distinct user roles ( administrators, members, guests) with different permission levels. Each user is assigned specific access rights to particular data elements, allowing fine-grained control over who can view, edit, or delete information, thus maintaining security while enabling authorized access.
Solution Approach 2:
The system implements local quality by providing customized access control policies for different user groups. Each user or group receives tailored permission settings based on their role, allowing administrators to define specific data access rights for members and guests, thereby securing sensitive information while maintaining operational ease for authorized users.
2Reliability
If access control is strictly limited to users only, then data privacy is improved, but ease of sharing with contacts is reduced
Solution Approach 1:
The system segments access control into multiple hierarchical levels: users can designate specific contacts as members or guests with varying permission levels. This segmentation allows users to maintain privacy by limiting access to selected individuals while still enabling convenient sharing with trusted contacts, balancing security with ease of collaboration.
Solution Approach 2:
The system implements dynamic access control where users can flexibly adjust permission settings for different contacts. Members can be granted full access, while guests receive limited access to specific data elements. This dynamic configuration enables users to maintain privacy when needed while easily sharing data with contacts based on trust levels, without compromising overall data security.
3Ease of operation
If encryption keys are stored on server for centralized management, then ease of key management is improved, but system operators gain unauthorized access capability
Solution Approach 1:
The system extracts encryption keys from centralized server storage and implements client-side key management. Each user stores their own encryption keys locally on their device, eliminating the need for servers to hold master keys. This extraction prevents system operators from accessing user data even though key management remains convenient through automated client-side handling.
Solution Approach 2:
The system introduces a trusted third-party key management service that facilitates secure key exchange between users without requiring servers to store decryption keys. The intermediary service enables users to share keys with contacts while maintaining control over the keys themselves, preventing operator access while simplifying the key management process through automated cryptographic operations.
Data Source
AI summary
A novel architecture for a data sharing system (DSS) is disclosed and seeks to ensure the privacy and security of users' personal information. In this type of network, a user's personally identifiable information is stored and transmitted in an encrypted form, with few exceptions. The only key with which that encrypted data can be decrypted, and thus viewed, remains in the sole possession of the user and the user's friends/contacts within the system. This arrangement ensures that a user's personally identifiable information cannot be examined by anyone other than the user or his friends/contacts. This arrangement also makes it more difficult for the web site or service hosting the DSS to exploit its users' personally identifiable information. Such a system facilitates the encryption, storage, exchange and decryption of personal, confidential and/or proprietary data.