Trusted Data Decryption via Privacy-Preserving Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security methods face challenges in ensuring secure decryption and transmission of data, as encryption keys can be compromised, and decrypted data may leak due to insecure storage and transmission paths.
Innovation Solution
A method for trusted data decryption based on privacy-preserving computation, where asymmetric encryption keys are generated in a trusted execution environment, and the decryption key is calculated using measurement values and a token, ensuring that data can only be decrypted in a trusted environment and transmitted securely without exposing the key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted and stored in volatile memory with a fixed key for secure decryption, then data security against illegal theft is improved, but the key remains vulnerable to leakage through external software or kernel-level access
Solution Approach 1:
The patent extracts the decryption key from the volatile memory where it was previously stored and replaces it with a key derivation function that generates keys dynamically from measurement values. This removes the vulnerable stored key while maintaining decryption capability through computational derivation instead of storage.
Solution Approach 2:
The patent introduces measurement values (hash values of application binaries and environment parameters) as an intermediary between the encrypted data and the decryption process. These measurement values serve as a mediator that enables key generation without requiring direct access to a stored secret key, thereby eliminating the key leakage vulnerability.
2Ease of operation
If decrypted data is transmitted to a requesting party, then data usability is improved, but the transmission path becomes insecure and data leakage risk increases
Solution Approach 1:
The patent changes the fundamental parameter of data transmission from transmitting decrypted plaintext data to transmitting encrypted data along with measurement values and key derivation algorithms. This parameter change allows the data to remain encrypted during transmission while still being usable by the requesting party who possesses the same measurement values to derive the decryption key independently.
3Ease of operation
If a data key is stored for decryption purposes, then data decryption capability is improved, but the key can be stolen and data decrypted illegally
Solution Approach 1:
The patent implements self-service decryption where the decryption key is generated autonomously by the system itself through a key derivation function that uses measurement values as input. Instead of relying on externally stored keys that can be stolen, the system serves its own key generation needs through computational derivation, making the key impossible to steal but easy to regenerate.
Data Source
AI summary
A new method for trusted data decryption is disclosed. A data user provides a public key Pk of an encryption key generation algorithm G. A data provider calculates an encryption key K based on an application A, a device C, and a token T by using G, encrypts a data set D by using K, encrypts G by using Pk to obtain Ge, and transmits ED and Ge to the data user. The data user can obtain a private key generation algorithm G′ by using a locally stored private key Ps, and measures, in a trusted execution environment, the application A and the device C that request data to obtain MA′ and CID′, calculates an encryption key K′ based on MA′, CID′ and a user-input token T by using G′, and decrypts ED by using K′. If K′=K, the decryption succeeds, and data D is obtained; otherwise, the decryption fails.