Time-Based Cryptographic Key Management for Data Invalidation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face inefficiencies and increased latency due to the frequent decryption and re-encryption of time-controlled data using crypto shredding techniques, consuming significant computing resources and reducing overall system performance.
Innovation Solution
A system generates a set of cryptographic keys corresponding to future time periods, encrypting data with keys specific to the expiration time, and deletes or overwrites these keys upon expiration, minimizing the need for repeated encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If crypto shredding techniques are used to destroy time-controlled data by frequent decryption and re-encryption, then data security is improved, but computing resource consumption increases and system performance decreases
Solution Approach 1:
The patent applies preliminary action by pre-generating cryptographic keys for future time periods before they are needed. When data needs to be encrypted for a specific future time period, the system already has the appropriate key ready, eliminating the need for repeated decryption and re-encryption operations. This resolves the contradiction by maintaining security through proper key management while dramatically reducing computing resource consumption.
Solution Approach 2:
The patent uses copying by creating multiple cryptographic keys that represent different time periods. Instead of repeatedly encrypting/decrypting data with the same key, the system creates copies of the data encrypted with different time-specific keys. This allows efficient key rotation and data destruction without continuous computational overhead, improving both security and performance.
2Reliability
If crypto shredding techniques are used to invalidate time-controlled data, then data access control is improved, but latency increases due to repeated encryption and decryption operations
Solution Approach 1:
The system performs preliminary action by pre-generating cryptographic keys for future time periods and storing them for quick retrieval. When data access is requested, the system can immediately use the pre-generated key corresponding to the required time period without undergoing time-consuming encryption/decryption cycles. This maintains strict access control while minimizing latency.
3Reliability
If cryptographic keys are frequently rotated for time-controlled data, then security is improved, but computing resource consumption increases
Solution Approach 1:
The patent resolves this contradiction by performing key generation in advance for multiple future time periods. Instead of generating and rotating keys frequently during data operations, the system prepares a set of time-specific keys beforehand. This maintains strong security through key rotation while eliminating the computational overhead of frequent key generation and encryption/decryption operations.
Solution Approach 2:
The system uses copying by creating multiple cryptographic key copies for different time periods. Each key is designed for a specific time window, allowing the system to use the appropriate pre-generated key without frequent key rotation operations. This reduces computing resource consumption while maintaining security through time-based key differentiation.
Data Source
AI summary
Methods and systems for cryptographic key management for time controlled data are provided herein. A request to store a data item associated with a time controlled application at a data structure is received. A time period during which the data item is to be invalidated is determined based on a data access protocol for the time controlled application. A cryptographic key that is pre-generated for a future time period corresponding to the determined time period is identified. The data item is caused to be encrypted using the identified cryptographic key. The encrypted data item is stored at the data structure in accordance with the received request.