Shared Folder Password Encryption Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional credential storage systems lack flexibility and security in sharing login information across multiple services, as they rely on a single set of credentials, leading to network security risks and data loss.
Innovation Solution
The system encrypts a shared key within a payload for a shared folder and securely shares passwords across computing devices by using key exchange and key rotation with public encryption keys, ensuring only authorized devices can access the encrypted content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single set of credentials is used to access login information for different services, then credential storage is simplified, but access flexibility and security are limited
Solution Approach 1:
The patent segments the credential storage system into multiple independent user accounts, each with their own encryption keys. Instead of a single centralized credential store, the system divides credentials into separate encrypted containers that can be independently accessed and shared by different users based on their specific needs.
2Ease of operation
If credentials are provided to a second user to share login information, then access is enabled, but all login information becomes accessible rather than selective sharing
Solution Approach 1:
The patent implements local quality by assigning different access permissions to different users for different credential containers. Each user account has specific encryption keys that allow them to access only the credentials they are authorized to view, while other credentials remain encrypted and inaccessible. This enables selective sharing where User A can access Service X credentials while User B can access Service Y credentials, but neither can access the other's credentials.
3Adaptability or versatility
If a sharing group allows former members to continue accessing secure data, then group collaboration is maintained, but network security is compromised
Solution Approach 1:
The patent implements dynamic access control where user permissions and encryption key associations are automatically updated when users are added or removed from sharing groups. When a user leaves a group, their encryption key is rotated and they lose the ability to decrypt previously accessible credentials. This dynamic key management ensures that access rights are continuously aligned with current group membership, preventing former members from accessing secure data they are no longer authorized to view.
4Reliability
If encryption keys are rotated across client devices, then security is enhanced, but data loss occurs due to asynchronous connections and key version differences
Solution Approach 1:
The patent implements preliminary action by establishing a centralized server that coordinates key rotation across all client devices before actual credential access occurs. The server maintains the authoritative version of encryption keys and distributes updated keys to all devices in advance of any potential access needs. This coordinated approach ensures all devices synchronize to the same key version, preventing data loss that would occur if devices independently rotated keys at different times with asynchronous connections.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
This disclosure describes methods, non-transitory computer readable storage media, and systems that provide secure password sharing across a plurality of users and client devices via a shared folder. For example, in one or more embodiments, the disclosed system retrieves a public key set including public encryption keys for client devices having access to the shared folder. The disclosed system provides the public key set to a client device requesting to share the shared folder. The disclosed system receives an encrypted payload for the shared folder and a shared encryption key that is utilized to encrypt the payload and is encrypted in the shared folder utilizing the public key set. The disclosed system also detects key rotation events and notifies one or more client devices to generate a modified shared encryption key and re-encrypt the payload for storage within the shared folder.