Data Access Management Using Sensitivity-Based Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access management systems face challenges in securely managing access to sensitive data, as malicious parties can gain access through compromised user credentials or device vulnerabilities.
Innovation Solution
The implementation of a security registration process that assigns cryptographic key pairs to user-device combinations, managed using a tree structure based on data sensitivity levels, along with device-specific encryption and decryption processes, to enhance data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional access control measures are implemented, then ease of operation is improved, but reliability is worsened due to compromised credentials
Solution Approach 1:
The patent segments the cryptographic key into multiple portions and distributes them across multiple devices. No single device holds the complete key, so even if one device is compromised, the attacker cannot reconstruct the full key to access the sensitive data. This directly addresses the reliability issue by preventing credential compromise from leading to data breach.
Solution Approach 2:
The patent introduces a secret sharing mechanism as an intermediary between the user credentials and the sensitive data. The secret sharing system acts as a mediator that requires multiple authorized devices to collaborate before the complete key can be reconstructed, adding a layer of security that prevents direct access even if some credentials are compromised.
2Reliability
If device-specific encryption is implemented, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal secret sharing scheme that can be applied across multiple devices and data types. The same cryptographic framework and key distribution mechanism work consistently whether protecting one file or many, whether across one device or multiple devices. This universality reduces the relative complexity by using a standardized approach rather than custom solutions for each case.
3Reliability
If multiple key pairs are assigned to user-device combinations, then reliability is improved, but loss of information increases due to key management overhead
Solution Approach 1:
The patent extracts the key management complexity from the user's direct control and transfers it to the secret sharing infrastructure. Users don't need to manually manage multiple key pairs; instead, the system automatically handles key generation, distribution, and reconstruction through the secret sharing mechanism. This extraction reduces the perceived information loss by removing the burden of key management from users.
Data Source
AI summary
Methods and systems for managing access to data stored in data storage systems are disclosed. An end device and/or user thereof may require access to sensitive data of varying sensitivity levels stored in a data storage system. To prevent malicious parties from gaining access to the sensitive data, an access control system may be implemented. The access control system may include a registration process that registers end device and user combinations and assigns cryptographic key pairs to each registered combination. The key pairs may be generated using information specific to the sensitivity level of the data and managed using a key tree structure. Before sensitive data may be accessed, a requesting device and its associated user may be authenticated using the key pairs generated during registration. The sensitive data may be encrypted using sensitivity level and device-specific encryption.