Secure File Storage Using Split Key Management and Encrypted File Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file storage services are vulnerable to security breaches due to the storage of file keys in account servers, which can be exploited by hackers, leading to unauthorized access to file data.
Innovation Solution
A secure file storage method using multiple keys and key pairs, involving a user terminal, interface server, and key server, employs asymmetric encryption and oblivious pseudo random functions to generate and manage encrypted keys, ensuring secure file storage and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If file keys are stored in the account server for convenient file access, then file retrieval efficiency is improved, but security vulnerability increases due to potential key leakage
Solution Approach 1:
The patent extracts the file key storage function from the account server and relocates it to the third-party server. The account server no longer stores file keys, but instead stores only encrypted file data. When users need to access files, the system generates temporary decryption keys that are not permanently stored in the account server, thereby eliminating the security vulnerability of centralized key storage while maintaining convenient file access.
Solution Approach 2:
The patent introduces an intermediary mechanism where the third-party server acts as a mediator between the account server and the user. The third-party server receives encrypted file data from the account server, generates temporary decryption keys, and provides these keys to users for file access. This intermediary approach allows file retrieval to remain efficient while preventing direct storage of keys in the account server.
2Reliability
If multiple keys and encryption technologies are implemented to protect file keys, then security is improved, but system complexity increases
Solution Approach 1:
The patent segments the encryption and key management functions across multiple independent components: the account server handles encryption of file data, the third-party server manages key generation and distribution, and the user terminal performs local decryption. Each component has a specific, limited function rather than handling all encryption operations centrally. This segmentation reduces the complexity burden on any single system while maintaining comprehensive security through distributed key management.
Data Source
AI summary
A method and a system for secure file storage are provided, which generate an initial key according to a password inputted by a user, and then generate a code key pair, a signature key pair, and a plaintext file key corresponding to a file. The private keys in the two key pairs are stored after being encrypted with the initial key, the plaintext file key is stored after being encrypted with the public key in the code key pair, and the signature key pair is used to generate and validate the signatures of the user terminal. In addition, the file is stored after being encrypted with the plaintext file key. Therefore, a more secure file storage service is provided based on the aforementioned architecture.