Secure Transaction System Using Per-User Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing user data in enterprise storage provide a false sense of security as the encryption key used for all records still needs to be stored, making it vulnerable to access by malicious individuals if they gain access to the database or server.
Innovation Solution
A computer-implemented method for secure user authentication and data protection involves generating an authentication code from a supplied security code, storing it, and using it to encrypt and decrypt transaction payloads during user login, thereby preventing unauthorized access to user data both in transit and at rest.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single encryption key is used to encrypt all user records, then data protection is simplified, but system security is compromised because the key must be stored on servers and can be accessed by malicious individuals
Solution Approach 1:
The patent divides the single encryption key into multiple per-user keys. Each user has their own unique encryption key stored in the database, eliminating the need for a master key on servers. This segmentation resolves the contradiction by making each key independent and inaccessible to others, including malicious individuals with database access.
Solution Approach 2:
The patent extracts the encryption key from server storage and places it directly in the user's database record. This removes the vulnerable centralization of keys from the server and distributes them throughout the database, where they are protected by individual user authentication mechanisms.
2Ease of operation
If password and PEK are transmitted during transaction, then authentication can be completed, but security is weakened because malicious individuals can sniff the information and make targeted attacks
Solution Approach 1:
The patent introduces a symmetric encryption mechanism as an intermediary layer between the client and server. The client generates a random symmetric key, encrypts the PEK with this key, and transmits the encrypted data. The server decrypts using the same symmetric key. This intermediary encryption layer prevents direct transmission of sensitive data, resolving the sniffing vulnerability while maintaining authentication functionality.
Data Source
AI summary
The present invention herein relates to method and system for authenticating user, protecting user data, and resetting security code. One of the advantages of the present invention is the protection of data in transit to ensure a secure user authentication and user data protection both in transit and at rest. Another advantage of the present invention is through a new security code resetting method, user can be verified without the need of storing the user verification data in the platform.