Product Security System Using Segmented Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing product security systems lack robust data security measures, allowing unauthorized access and potential misuse by database providers, as they can access and decrypt sensitive information without the need for specific machine-readable information.
Innovation Solution
Implementing encrypted data sets in a product security system where the decryption key or part of the encrypted data is applied in a machine-readable format, limiting access to only when the corresponding information is present, and dividing encrypted data into main and remainder parts to prevent unauthorized decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the database provider stores encrypted data sets and can decrypt them without additional verification, then the ease of operation is improved, but the data security deteriorates as the provider can access and misuse sensitive information
Solution Approach 1:
The decryption capability is segmented into two parts: the encrypted data set stored in the database and the machine-readable information applied to the product. Neither part alone can decrypt the data; both are required together, preventing unauthorized access while maintaining operational efficiency
Solution Approach 2:
The machine-readable information on the product acts as an intermediary that bridges the encrypted data in the database and the decryption process. This intermediary ensures that only authorized parties with the corresponding machine-readable information can access the data, enhancing security without complicating the overall system operation
2Device complexity
If the decryption key is stored only in the database, then the device complexity is reduced, but the data security deteriorates as the database provider has full access to decrypt any data
Solution Approach 1:
The decryption key functionality is segmented between the database (encrypted data set) and the product (machine-readable information). This segmentation ensures that even if one component is compromised, the other remains protected, maintaining security while keeping the system structure relatively simple
Solution Approach 2:
The security model transitions from a single-dimension storage (key in database) to a two-dimension system where the decryption capability exists in both the database and on the product itself. This dimensional change distributes trust and security across multiple locations without significantly increasing overall system complexity
3Reliability
If the encrypted data set is divided into main part and remainder, then the data security is improved by preventing unauthorized decryption, but the device complexity increases due to the division and coordination of multiple data parts
Solution Approach 1:
The encrypted data set is segmented into a main part stored in the database and a remainder stored as machine-readable information on the product. This segmentation ensures that neither part alone can be decrypted, providing robust security. The segmentation is straightforward and does not require complex coordination mechanisms
Solution Approach 2:
Instead of storing the complete encrypted data set in the database, only the main part is stored there, while the remainder is placed on the product. This partial storage approach enhances security by ensuring that the complete data cannot be accessed without both components, while the division itself is simple and does not add significant structural complexity
Data Source
AI summary
The present invention relates to a product information system and a corresponding method in a product information system with products 2, to which there are applied machine-readable items of information 14. A data service 5 for data 16 allocated to the products is furnished. The machine-readable item of information 14 applied to a product 2 are read by a data requester 4. The data allocated to the product are requested through sending the read machine-readable data to the data service 5, the data request 15 is received by the data service 5, the requested data 16 are determined by the data service 5 and sent by the data service 5 to the data requester 4. In the step of determining the requested data 16, the data are generated by decrypting encrypted data 11-13 using the machine-readable items of information 14 received with the data request.