Sensitive Data Management via Symmetric Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional sensitive data management systems face challenges in ensuring the security and accessibility of sensitive data, particularly in scenarios where emergency recovery and decryption processes are complex and vulnerable to data leakage.
Innovation Solution
A sensitive data management apparatus that generates and encrypts sensitive data using a symmetric encryption key, deletes the key after encryption, and employs a public key for additional encryption of a sensitive data protection code, ensuring that only authorized terminals can decrypt and access the data, with multiple terminals used for backup and emergency access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a symmetric encryption key is used to encrypt sensitive data, then encryption speed and efficiency are improved, but security is worsened because the key must be stored and managed, creating vulnerability to data leakage
Solution Approach 1:
The patent divides the encryption system into two parts: a symmetric encryption key for fast data encryption and a public key for protecting the symmetric key. This segmentation allows the system to achieve both high encryption speed (using symmetric encryption) and enhanced security (by not storing the symmetric key in plain text), resolving the contradiction between productivity and reliability.
Solution Approach 2:
The patent introduces a public key as an intermediary mechanism to protect the symmetric encryption key. Instead of storing the symmetric key directly (which would compromise security), the system encrypts the symmetric key with the public key, creating a secure intermediary layer that enables both efficient encryption and robust security.
2Ease of operation
If the symmetric encryption key is stored for emergency recovery, then accessibility in emergency situations is improved, but security is worsened due to increased vulnerability to data leakage
Solution Approach 1:
The patent implements preliminary action by pre-storing the public key in the management apparatus before encryption occurs. This allows the system to prepare for emergency recovery scenarios in advance, enabling users to retrieve encrypted data by providing their public key without compromising security, as the symmetric key itself is never stored.
Solution Approach 2:
The patent creates a copying mechanism where the public key is stored as a copy of the encryption capability rather than the actual symmetric key. This copy allows emergency recovery and data accessibility while maintaining security, as the stored public key cannot be used to decrypt data without the corresponding private key.
3Adaptability or versatility
If multiple public keys are managed for different terminals, then adaptability and backup capability are improved, but device complexity increases
Solution Approach 1:
The patent applies universality by implementing a single public key storage mechanism that serves multiple functions: it enables emergency recovery, supports multiple terminal backups, and maintains security across different devices. The management apparatus stores public keys in a unified manner that can be retrieved for various purposes, reducing complexity compared to managing separate key systems for each function.
Data Source
AI summary
An aspect of the present invention is provided with a sensitive data protection code generating unit which generates a sensitive data protection code of a predetermined data length, a symmetric encryption key generating unit which generates a symmetric encryption key by using a key derivation function that takes, as input, the sensitive data protection code, a sensitive data encrypting unit which encrypts sensitive data by using the symmetric encryption key, a sensitive data protection code encrypting unit which encrypts the sensitive data protection code by using a public key provided from an sensitive data access support terminal, and a deleting unit which deletes the symmetric encryption key and the sensitive data after the encryption of the sensitive data, and deletes the sensitive data protection code after the encryption of the sensitive data protection code.