End-to-End Sensor Data Encryption With Proxy Re-Encryption Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to ensure secure access to sensor data captured by remote devices while limiting access to the service provider's compute device, necessitating enhanced security and privacy measures.
Innovation Solution
Implementing end-to-end encryption techniques using key rotations and proxy re-encryption across multiple compute devices, ensuring only the user's compute device can decrypt encrypted sensor data, while leveraging existing SSO solutions like Okta and Azure Active Directory for seamless integration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the service provider's compute device stores and processes sensor data, then data accessibility and processing capability are improved, but security and privacy are worsened because the service provider gains access to decrypted data
Solution Approach 1:
The patent introduces a key management compute device as an intermediary that holds encrypted keys and only releases decryption keys after successful authentication. This mediator enables the service provider to process data while preventing unauthorized access to sensitive information, as the service provider never possesses the actual decryption keys.
Solution Approach 2:
The system segments the decryption capability by separating the encryption keys from the data processing function. The key management compute device holds the encrypted keys and authentication logic, while the service provider's compute device performs data processing. This segmentation ensures that even if the service provider's device is compromised, the attacker cannot decrypt the data without the keys held by the key management device.
2Productivity
If encryption keys are stored on the service provider's compute device for easy decryption, then data processing efficiency is improved, but security is worsened due to potential key exposure
Solution Approach 1:
The key management compute device acts as a secure intermediary that maintains the encryption keys. When data processing is needed, the service provider's device requests temporary decryption keys through an authenticated process. This allows efficient data processing when needed while maintaining key security, as the keys never reside on the service provider's device but are temporarily provided through a secure channel.
Solution Approach 2:
The system performs preliminary authentication and key release actions before data processing occurs. The service provider must authenticate through the key management compute device and receive temporary decryption keys before any data processing can take place. This preliminary action ensures that key security is maintained while enabling efficient processing when authorized.
3Adaptability or versatility
If new users are granted access to sensor data, then system versatility and user access are improved, but security management complexity increases requiring real-time admin intervention
Solution Approach 1:
The key management compute device implements self-service functionality that automatically handles user authentication and key distribution. When a new user is added to the system, the key management device automatically provisions the necessary decryption keys through the authentication process without requiring manual admin intervention for each user. This maintains security while reducing operational complexity.
Solution Approach 2:
The authentication system is designed to be universal, handling multiple users and devices through a single standardized process. The key management compute device can service multiple users and devices using the same authentication and key distribution mechanism, eliminating the need for separate manual configurations for each user and reducing overall system complexity.
4Adaptability or versatility
If multiple versions of encryption keys are maintained for different devices, then system adaptability is improved, but key management complexity increases
Solution Approach 1:
The key management compute device automatically manages multiple key versions through self-service functionality. When different devices or users need different key versions, the system automatically provides the appropriate version based on authentication credentials without requiring manual tracking or distribution of multiple key versions. This maintains device compatibility while simplifying key management.
Solution Approach 2:
The system uses parameter changes in the form of different key versions that are automatically selected based on device or user parameters. The key management compute device stores multiple versions of encryption keys and automatically selects and provides the appropriate version based on the requesting device's identity and permissions. This allows adaptability to different devices while the system automatically manages the complexity of maintaining multiple versions.
Data Source
AI summary
A first document including a decrypting version of a first key and a second document including a representation of a login token are received from the first compute device. An encrypted second key that has been encrypted by an encrypting version of the first key is received after receiving the login token from a second compute device. The second compute device stores the encrypting version of the first key before the receiving of the first document. The encrypted second key is decrypted using the decrypting version of the first key to obtain a plaintext second key. Encrypted sensor data that includes plaintext sensor data that has been (1) captured prior to the receiving of the first document, and (2) encrypted by the plaintext second key is received from the second compute device. The encrypted sensor data is decrypted using the plaintext second key to obtain the plaintext sensor data.