Secure Data Transmission via Key Segmentation and Double Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data transmission methods between client and server devices are insecure, as the communication channel is susceptible to interception, and existing encryption methods do not adequately protect data from unauthorized access, especially when multiple encryption keys are required for decryption.
Innovation Solution
A method and system for secure data transmission involving double-encryption, where a client device and server device collaborate using shared encryption keys and hash functions to decrypt double-encrypted data, ensuring that no single party can decrypt the data without both shares of the keys, thereby maintaining data security even if the channel is intercepted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is transmitted over an unsecured communication channel between server device and client device, then data can be freely accessed and transmitted, but the data becomes susceptible to interception by third parties
Solution Approach 1:
The encryption key is segmented into multiple shares that are distributed between the server device and client device. Neither party possesses the complete key alone, requiring collaboration for decryption. This segmentation prevents third-party interception from resulting in complete key compromise, as each party holds only a portion of the cryptographic secret.
Solution Approach 2:
Data is encrypted in advance using multiple keys before transmission. The double-encryption process occurs beforehand, so that even if interception occurs during transmission, the captured data remains encrypted and unusable without both key shares for decryption.
2Ease of operation
If single encryption is used for data transmission, then decryption is simpler and faster, but security is insufficient against determined attackers
Solution Approach 1:
The cryptographic key is divided into multiple shares using secret sharing methodology. The server device holds one share and the client device holds another share. Both shares are required to reconstruct the full encryption key for decryption, creating a distributed trust model that enhances security while maintaining operational feasibility.
Solution Approach 2:
The patent implements double-encryption where data is encrypted with one key, then encrypted again with another key. This nested encryption structure requires sequential decryption with both keys, significantly enhancing security against attackers while preserving the ability for authorized parties to decrypt the data.
3Reliability
If multiple encryption keys are required for decryption, then security is enhanced against unauthorized access, but the decryption process becomes more complex
Solution Approach 1:
The key management system segments the encryption key into shares that are distributed across different devices. This segmentation allows the system to maintain strong security through multiple keys while managing complexity through automated key share distribution and reconstruction protocols.
Solution Approach 2:
The patent introduces an intermediary key share distribution mechanism that mediates between the server device and client device. This intermediary process automatically manages the exchange and combination of key shares, reducing the perceived complexity for end users while maintaining the security benefits of multiple encryption keys.
Data Source
AI summary
A method is disclosed of secure data transmission comprising sending a data request from a client device to a server device, the data request comprising a first share of a first encryption key, and a first location in the database at which is located desired double-encrypted data; receiving the sent data request at the server device; extracting, at the server device, the first share and the first location from the received data request; obtaining, at the server device, the desired double-encrypted data from the database using the extracted first location; generating, at the server device, the first encryption key using the extracted first share and one or more additional shares of the first encryption key held by the server device; and decrypting, at the server device, the obtained desired double-encrypted data using the generated first encryption key to form single-encrypted data.