Decentralized Storage Cache Encryption Key Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Individual blockchain transactions have limited data storage capacity, typically in the order of single kilobytes, which restricts the amount of data that can be stored within a blockchain network, necessitating off-chain storage solutions to accommodate larger data volumes required by decentralized applications (DApps).

Innovation Solution

Implementing off-chain decentralized storage systems that utilize arbitrary backend storage providers, such as cloud storage or local disks, interfaced through a storage server, allowing users to manage their data caches and grant authorization to multiple DApps while maintaining control over their encrypted data, using cache-specific private keys and encryption keys for secure access and revocation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Volume of stationary object

If off-chain storage is implemented to increase storage capacity, then storage volume is improved, but data security and access control become more complex

Engineering Contradiction:

Improvestorage capacityVSAvoidencryption key management

Core Design Contradiction:

Volume of stationary objectVSDevice complexity

Solution Approach 1:

The patent segments encryption keys into two distinct types: data cache-specific private keys for access control and file-specific encryption keys for data protection. This segmentation allows independent management of access permissions and encryption, simplifying the overall key management complexity while enabling multi-terabyte storage capacity through off-chain backend storage providers.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary authentication mechanism where the storage server verifies DApp authorization credentials against the data cache-specific private key before granting access. This intermediary layer manages the complexity of key distribution and revocation, allowing multiple DApps to access the same encrypted storage without requiring each DApp to manage separate encryption keys, thus scaling storage capacity while controlling complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If multiple DApps share the same data cache to improve resource utilization, then storage efficiency is improved, but access control and security become more complex

Engineering Contradiction:

Improvestorage efficiencyVSAvoidauthorization management

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent implements a universal data cache-specific private key that serves multiple DApps simultaneously. This single key manages authorization for all registered DApps accessing the data cache, eliminating the need for separate keys per DApp. The storage server handles universal authentication and credential verification, simplifying authorization management while enabling efficient shared storage access across multiple applications.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If encryption is applied to each file to enhance security, then data security is improved, but computational overhead and storage complexity increase

Engineering Contradiction:

Improvedata securityVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent segments encryption into two distinct layers: data cache-specific private keys for access control and file-specific encryption keys for individual file protection. This segmentation enables selective encryption where only accessed files are decrypted, reducing computational overhead compared to encrypting/decrypting entire storage volumes. The file-specific encryption keys are derived deterministically from the data cache-specific private key and file identifiers, minimizing key management overhead while maintaining strong security.

Inventive Principle:

Principle #1Segmentation

4Ease of operation

If deterministic key derivation is used to reduce key management overhead, then ease of operation is improved, but security risks from key derivation vulnerabilities increase

Engineering Contradiction:

Improvekey managementVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent uses parameter changes in the deterministic key derivation process by incorporating unique file identifiers (such as file names or hashes) as additional parameters alongside the data cache-specific private key. This approach maintains ease of operation through automated key generation while enhancing security by ensuring that each file has a unique, unpredictable encryption key even within the same data cache. The derived file-specific encryption keys are used only for their intended files, limiting the impact of any potential derivation vulnerabilities.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS10664451B1Systems and methods for encrypting data in backend storage caches shared by multiple decentralized applications

Publication Date: 2020.05.26 HIRO SYST PBC

AI summary

In a decentralized system based on a blockchain, a storage server directs the off-chain storage of shared data for multiple decentralized applications in data caches on a backend storage provider, such that a user's client and any authorized decentralized applications can access encrypted data in the data caches, but the storage server performs no encryption of that data and is not exposed to encryption keys and unauthorized decentralized applications cannot access the encrypted data.