Role-Based Encryption Without Key Management System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Role-based security systems require a dedicated key management system for managing user permissions, which is difficult to protect and maintain, especially in enterprise and distributed environments.
Innovation Solution
A role-based security infrastructure generates unique key pairs for each defined role, using random encryption keys for data encryption and storage, allowing access through public and private key encryption, enabling key replacement, addition, and revocation without a key management system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a dedicated key management system is employed to manage user permissions in role-based security systems, then user permission management is enabled, but the system becomes difficult to protect and maintain
Solution Approach 1:
The patent extracts the key management functionality from a separate dedicated key management system and integrates it directly into the role-based security infrastructure. Each role's private key is embedded within the role definition itself, eliminating the need for an external key management system while maintaining the ability to manage user permissions through role assignments.
Solution Approach 2:
The role-based security system becomes self-sufficient by containing all necessary cryptographic keys within the role definitions. The system manages its own authentication and authorization without requiring external key management infrastructure, as each role inherently possesses the cryptographic material needed to enforce its access controls.
2Adaptability or versatility
If a dedicated key management system is used for role-based encryption, then key management operations are possible, but system complexity increases
Solution Approach 1:
The patent merges the key management operations with the role definition data structures. Instead of maintaining separate key storage and management mechanisms, the cryptographic keys are integrated directly into the role definitions, combining what were previously separate functions into a unified system that reduces overall complexity.
Solution Approach 2:
The role definition structure serves multiple functions simultaneously: it defines access permissions, specifies cryptographic keys, and manages authentication. This multi-functional approach eliminates the need for separate key management systems while maintaining full key management operational capability.
Data Source
AI summary
A role based security infrastructure for data encryption that does not require a key management system is provided. For each defined role, a unique key pair is generated. To encrypt a data set, a random encryption key is generated on the fly, and used to encrypt the data. To allow a role access to an encrypted data set, the corresponding encryption key is encrypted with the public key of that role, and stored in association with the encrypted data set. To access an encrypted data set, a private key associated with a role allowed access is used to decrypt the copy of the associated encryption key, which has been encrypted using the corresponding public key and stored in association with the data set. The decrypted encryption key is then used to decrypt the encrypted data set.