Secure Data Container with Multi-Level Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure data distribution technologies, such as SSL and IPsec, face scalability issues due to significant overhead in setting up secure channels, especially for microtransactions or distributing content to multiple consumers, and require direct producer involvement in authorization, which can lead to security and privacy concerns.
Innovation Solution
A digital container system is used where key information is shared to create encrypted data objects with different encryption levels and metadata, allowing secure transport and access control, with key distribution managed through a key distributor and authorisation server, enabling efficient and secure decryption by authorized users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL or IPsec is used to set up secure channels for data distribution, then data security is improved, but system overhead and complexity increase significantly
Solution Approach 1:
The patent extracts the security management function from the data distribution system by introducing a separate key distributor. The actual data remains encrypted with content encryption keys, while only key management operations are performed by the key distributor, separating security overhead from data transmission overhead
Solution Approach 2:
The patent introduces a key distributor as an intermediary between the data distributor and authorized users. This mediator handles key management and authorization, allowing secure data distribution without requiring direct secure channel setup between all parties, thus reducing system complexity
2Reliability
If SSL or IPsec secure channels are established for each transaction, then data security is maintained, but scalability deteriorates when distributing to multiple consumers
Solution Approach 1:
The patent creates a universal key distribution mechanism that serves multiple consumers simultaneously. The key distributor can issue appropriate keys to multiple authorized users based on their access rights, eliminating the need to establish separate secure channels for each consumer and enabling scalable distribution
Solution Approach 2:
The patent segments the security function into key management (handled by key distributor) and data distribution (handled by data distributor). This segmentation allows the data distribution system to scale independently while security is managed centrally, improving overall scalability
3Ease of operation
If the producer is directly involved in authorizing consumers, then access control is enforced, but security and privacy risks increase
Solution Approach 1:
The patent extracts the authorization function from the data producer and places it in the key distributor. The producer only needs to establish trust relationships with the key distributor, while all consumer authorization decisions are made by the key distributor, reducing the producer's security exposure
Solution Approach 2:
The key distributor acts as an intermediary that handles all authorization decisions between the data producer and consumers. This mediator protects the producer's privacy by not requiring direct knowledge of consumer identities while still enforcing access control policies
Data Source
AI summary
A system and method for secure transport of data, the method comprising: sharing of key information with a key distributor, wherein the key information is for enabling decryption of first and second encrypted data, the key distributor being for making one or more decryption keys available to an authorized user; creating a container object, the container object comprising: first encrypted data having a first encryption based on at least a part of said key information; second encrypted data having a second encryption based on at least a part of said key information, wherein the first encryption is different to the second encryption; and metadata relating to the first encrypted data and the second encrypted data; and sending the container object to a data store or otherwise making the container object available, to allow user access to said data container object.