Remote Decryption Key Storage for Data Theft Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face security vulnerabilities due to data theft and tampering risks, particularly during decommissioning and recycling, where sensitive data remains on storage devices and can be recovered even after deletion, and malicious insiders or hackers can access or manipulate data.
Innovation Solution
Implementing a system where data is encrypted and decryption keys are stored separately on a server, with unique key identifiers and decryption keys managed through a key ID database, ensuring that only the server can provide decryption keys upon authentication, thereby maintaining data security and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored locally on storage devices for easy access, then ease of operation is improved, but security against theft and tampering deteriorates
Solution Approach 1:
The patent extracts the decryption keys from the local storage device and stores them on a remote server. The encrypted data remains on the local device, but without the keys extracted and stored remotely, the data becomes inaccessible to unauthorized persons who might steal or tamper with the local storage device.
Solution Approach 2:
The patent introduces a server as an intermediary between the local storage device and the decryption keys. The server acts as a secure mediator that holds the keys and provides them only through authenticated requests, preventing direct access to keys while maintaining data accessibility for authorized users.
2Ease of operation
If decryption keys are stored locally with encrypted data, then ease of operation is improved, but reliability of data security deteriorates
Solution Approach 1:
The patent extracts decryption keys from local storage and relocates them to a remote server. This separation ensures that even if the local storage device is compromised, the keys remain secure on the server, maintaining reliability of data security while allowing easy decryption through server authentication.
Solution Approach 2:
The patent segments the data protection system into two separate components: encrypted data stored locally and decryption keys stored remotely on a server. This segmentation ensures that compromise of one component does not necessarily compromise the other, thereby maintaining security reliability while enabling operational ease through proper authentication.
3Object-affected harmful factors
If data deletion processes are applied to remove sensitive information, then loss of harmful factors is improved, but loss of time and resources increases
Solution Approach 1:
The patent applies preliminary encryption to data before it is stored or potentially exposed to threats. By encrypting data with keys stored on a remote server, the system ensures that even if the storage device is decommissioned or stolen, the data remains protected without requiring time-consuming deletion processes, as the encryption itself prevents unauthorized access.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are provided for adding security to client data by maintaining keys providing access to the client data remotely from the client data. In some circumstances, the systems encrypt a cluster of data using an encryption key, associate the cluster of encrypted data with a unique identifier and send the unique identifier and the decryption key to a server for storage. The decryption key is then received from the server and is used to decrypt the cluster of encrypted data. A server can also perform policy checks or trigger additional authentication such as SMS, phone, or email notification before allowing access to a key. Furthermore, in some instances, the server can also prevent access to the stored keys in response to anomalies, such as decommissioning and other asset management events.