Trust Engine Key Segmentation for Secure Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for secure remote storage and data sharing face challenges in protecting sensitive information across public and private networks, particularly in ensuring the security and accessibility of cryptographic keys and authentication data.
Innovation Solution
A cryptographic system that employs a trust engine to store and manage cryptographic keys and user authentication data, using secure servers to generate and distribute cryptographic keys, ensuring that private keys remain within the trust engine and are not exposed outside, while allowing users to access cryptographic functionality through any internet connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored on remote servers for data sharing, then data accessibility is improved, but security is worsened due to potential key exposure
Solution Approach 1:
The cryptographic system segments keys into two distinct types: workgroup keys stored securely in the trust engine for security, and sharable file-level keys distributed to authorized users for accessibility. This segmentation allows each key type to serve its specific purpose without compromising the other.
Solution Approach 2:
The trust engine acts as an intermediary between the workgroup key and authorized users. It generates sharable file-level keys from the workgroup key and distributes them to users who need access, without exposing the workgroup key itself. This intermediary mechanism enables secure key management while maintaining data accessibility.
2Adaptability or versatility
If workgroup keys are distributed to all users, then data sharing capability is improved, but security is worsened due to key exposure risks
Solution Approach 1:
Different key types are assigned to different users based on their specific needs. Workgroup keys remain localized in the trust engine for administrative functions, while sharable file-level keys are distributed only to authorized users who need file access. This localized key assignment enables targeted data sharing without universal key distribution.
Solution Approach 2:
The key management system segments the single workgroup key into multiple derived sharable file-level keys, each distributed to specific authorized users. This segmentation allows the system to provide data sharing capability to multiple users without exposing the parent workgroup key, as each user receives only their specific derived key.
3Adaptability or versatility
If cryptographic functionality is made portable across devices, then user independence is improved, but key security is worsened due to increased attack surfaces
Solution Approach 1:
The trust engine serves as a secure intermediary that generates and manages cryptographic keys remotely. Users can access cryptographic functionality on any device by connecting to the trust engine, which handles key generation and distribution securely. This intermediary approach enables portability without requiring users to store sensitive keys locally on multiple devices.
Solution Approach 2:
The system extracts the workgroup key from user devices and keeps it exclusively in the trust engine. Only the necessary sharable file-level keys are extracted and distributed to users for specific file access. This extraction approach enables users to access data on portable devices without exposing the parent workgroup key, reducing the attack surface.
Data Source
AI summary
Systems and methods are provided for creating and using a sharable file-level key to secure data files. The file-level key is generated based on a workgroup key associated with the data file and unique information associated with the data file. The file-level key may be used to encrypt and split data. Systems and methods are also provided for sharing data without replicating the data on an end user machine. Data is encrypted and split across an external/consumer network and an enterprise/producer network. Access to the data is provided using a computing image generated by a server in the enterprise/producer network and then distributed to end users of the external/consumer network. This computing image may include preloaded files that provide pointers to the data. No access or replication of the data on the enterprise/producer network is needed in order for a user of the external/consumer network to access the data.