Split Data Key Transmission for Third-Party Server Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In third-party service systems, sensitive data is vulnerable to leakage as it is encrypted and decrypted within the same request, passing through the third-party server, which compromises security.
Innovation Solution
A method and apparatus where the client terminal encrypts sensitive data and sends it to the provider server in a first request, obtaining a unique tag, and then sends the key and unique tag in a separate second request, allowing the provider server to decrypt the data without sharing the key in the same request, thereby preventing data leakage through the third-party server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the client terminal sends the key and encrypted data through the same request to the provider server, then the service processing efficiency is improved, but the data security deteriorates because the third party server can intercept both the key and encrypted data
Solution Approach 1:
The patent divides the transmission process into two separate requests: the first request transmits only the encrypted data to the third party server, while the second request transmits the decryption key directly to the provider server. This segmentation ensures that the third party server cannot obtain both the encrypted data and the key simultaneously, thus preventing data leakage while maintaining service efficiency.
2Adaptability or versatility
If the third party server forwards both the key and encrypted data to the provider server, then the service functionality is maintained, but the risk of data leakage at the third party server increases
Solution Approach 1:
The patent extracts the key transmission from the data transmission process. The encrypted data is forwarded by the third party server to the provider server, but the key is transmitted separately through a second request directly to the provider server, bypassing the third party server. This extraction eliminates the data leakage risk at the third party server while preserving the service functionality.
3Object-affected harmful factors
If separate requests are used for transmitting encrypted data and key, then data security is improved, but the service processing time increases
Solution Approach 1:
The patent implements preliminary action by having the client terminal encrypt the data and obtain the encrypted form before initiating the first request to the third party server. The third party server then processes the service logic and forwards the encrypted data to the provider server in advance. The key is transmitted separately in a second request, also in advance, to the provider server. This preliminary preparation minimizes the actual processing time when decryption is needed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for protecting encrypted data may includes encrypting, by a client terminal, the sensitive data by using a key in response to receipt of the sensitive data; sending the encrypted sensitive data to a provider server through a first request and obtaining a unique tag corresponding to the sensitive data; and sending the key and the unique tag to the provider server through a second request so that the provider server decrypts the sensitive data corresponding to the unique tag by using the key. The first request and the second request are different requests. Since the client terminal sends the encrypted sensitive data and the key to the provider server respectively in different requests, if others intercept the encrypted sensitive data, it is difficult to intercept the key carried in another request, and the encrypted sensitive data cannot be decrypted. Thus security of the sensitive data is protected.