Secure Link Sharing via Client-Side Key Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure document sharing and collaboration face challenges in protecting information from unauthorized access, as secure protocols can be compromised, and solutions that restrict sharing limit collaboration and usability.
Innovation Solution
A system and method for secure collaboration using a distributed computer system, where a user device generates a link key for a digital file, encrypts a session key, and shares it with another user device, enabling secure access and modification through secure password authentication and unique encryption for each file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure protocols are used to protect information during transmission, then data security is improved, but the protocols can be compromised by malicious actors allowing unauthorized access
Solution Approach 1:
The patent extracts the security-critical encryption keys from the transmission protocol itself and places them in separate secure storage locations on the client devices. The server stores only encrypted data without decryption keys, and clients store session keys locally rather than transmitting them through the protocol. This extraction prevents protocol compromise from exposing the keys, as the keys never traverse the network through the vulnerable protocol layers.
Solution Approach 2:
The security architecture is segmented into multiple independent components: the server handles only encrypted data storage, client devices handle key generation and local decryption, and session keys are separated from permanent encryption keys. This segmentation ensures that a compromise in one segment (the transmission protocol) does not expose the security of other segments (key storage and decryption operations).
2Reliability
If information sharing is restricted to maintain security, then unauthorized access is reduced, but collaboration and usability are limited
Solution Approach 1:
The patent implements local quality by allowing different security configurations for different files and users. Each file can have its own encryption key and access permissions, and each user can have individual session keys. This enables selective sharing where specific files can be collaboratively accessed by authorized users while maintaining security, rather than applying uniform restriction to all information.
Solution Approach 2:
The server acts as an intermediary that facilitates secure collaboration without having the ability to decrypt or access the actual file contents. It manages the encrypted data storage and coordinates access control, while the actual decryption and file operations occur locally on client devices. This intermediary role enables multiple users to collaborate on encrypted files without exposing the contents to the server or other users.
3Reliability
If encryption is applied to each file individually, then security against unauthorized access is enhanced, but the complexity of key management increases
Solution Approach 1:
The patent applies preliminary action by pre-generating encryption keys for files and session keys for users before the actual file access operations. The main encryption key is established in advance for each file, and session keys are generated beforehand for each user's access session. This preliminary key setup simplifies the actual file access process, as the heavy key management work is performed in advance rather than during each file operation.
Solution Approach 2:
Each client device performs self-service by generating and managing its own session keys locally without requiring centralized key distribution from the server. The devices independently handle key generation, storage, and decryption operations, eliminating the need for a complex centralized key management system and reducing overall system complexity while maintaining individual file security.
Data Source
AI summary
Methods and systems for sharing a network link of a file in network storage for collaboration among multiple computing devices using end-to-end encryption may involve generating a link key associated with the file stored remotely in the network storage, being accessible by a first device, and to be accessible by a second device, encrypting a session key associated with the file to generate an encrypted session key using the link key, the file being encrypted with the session key and, generating a salt associated with the file, generating a verifier associated with the file using the link key, sending a message to a server computer with an identifier associated with the file, the salt, the verifier, and the encrypted session key, creating a first link to the file with a name associated with the first device, the identifier, and the link key, and transmitting the first link to second device.