Secure Data Server Authentication via Subscriber Identity Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in securely managing sensitive information, particularly in central storage setups, where complex authentication and authorization processes are required, and there is a risk of unauthorized access and data privacy breaches.
Innovation Solution
A method and system for securely managing personal data storage units using a secure data server, where each unit is associated with a private key encrypted by a subscriber identity code and a personal scrambling key encrypted by a public key, enabling secure authentication and access management without complex certificate distribution, and incorporating multi-factor authentication and session key encryption for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates are distributed and installed on user terminals, then authentication and authorization can be performed, but the complexity of security management increases significantly for users
Solution Approach 1:
The patent extracts the certificate management functionality from the user terminal and relocates it to a centralized server. The server stores certificates and private keys, performing authentication operations remotely, thereby eliminating the need for users to manually install and manage digital certificates on their terminals while maintaining strong authentication security
Solution Approach 2:
The patent introduces a trusted third-party server as an intermediary between users and the authentication system. This server acts as a mediator that handles certificate storage, private key protection, and authentication operations, simplifying the user experience while ensuring cryptographic security through professional key management infrastructure
2Ease of operation
If sensitive data is centrally stored on a third-party server, then data access can be managed centrally, but the risk of unauthorized access and data privacy breaches increases
Solution Approach 1:
The patent segments the sensitive data into multiple encrypted components and distributes them across different storage locations. Critical data elements are encrypted with user-controlled keys, and the encryption keys themselves are separated from the encrypted data, ensuring that even if one component is compromised, the complete data remains protected
Solution Approach 2:
The patent applies preliminary encryption and security measures to data before it is stored on the server. User private keys encrypt sensitive information in advance, and multi-factor authentication mechanisms are pre-configured to prevent unauthorized access. This proactive security approach ensures that data remains protected even if the server is compromised
3Reliability
If strong authentication mechanisms are implemented, then security is improved, but the user experience becomes more complex and difficult to handle
Solution Approach 1:
The patent enables users to perform authentication and authorization operations through simple self-service interfaces. The server handles complex cryptographic operations automatically based on user credentials, allowing users to access their data and manage permissions without understanding the underlying security mechanisms, thus maintaining strong authorization security while simplifying user interaction
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and a system for managing one or more personal data storage units for securely and centrally storing sensitive data is described, wherein each of said personal data unit is connected to a secure data server and associated with a private key encrypted by a subscriber identify code and a personal scrambling key encrypted by a public key. The method comprises the steps of : receiving an access request from a client, said request comprising a subscriber identity code associated with a personal data storage unit; authenticating said client by decrypting the private key stored in said personal data storage unit using the subscriber identity code contained in said access request; storing the private key in a secure memory of the secure server, said private key being encrypted with a session key; and, transmitting the session key to said client.