Unique File Identifier for Policy-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file encryption methods struggle to balance access control and sharing, as they often require predefined permissions that cannot be easily changed and do not account for multiple copies of files, leading to unsecured files and inefficient key management.
Innovation Solution
A system that attaches a unique file identifier (UFI) to files and their copies, requiring central servers to evaluate access policies and send decryption keys only when permission is granted, ensuring secure access management across all copies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a shared key is used among a group of users to encrypt files, then file access control is simplified, but security is compromised because providing a shared key to people outside the group gives access to all files secured by the group key
Solution Approach 1:
The patent segments the file access control mechanism by attaching a unique file identifier (UFI) to each file and its copies. This allows individual file identification and tracking, enabling selective access control rather than group-wide key sharing. The UFI acts as a segmented identifier that distinguishes each file instance, resolving the contradiction between ease of control and security.
Solution Approach 2:
The patent introduces an intermediary permission file that contains the UFI and access control information. This permission file acts as a mediator between the encrypted file and the decryption process, allowing the system to enforce access control policies without exposing the actual decryption key until permission is verified. This intermediary layer maintains security while simplifying access control operations.
2Reliability
If permission files are attached to encrypted files with predefined permissions, then access control is enforced, but flexibility is reduced because permission changes are difficult and only affect singular copies
Solution Approach 1:
The patent implements dynamic permission management by storing access control policies in a centralized database associated with the UFI. When permission changes are needed, the system updates the policy in the database, and this change automatically applies to all copies of the file that present the same UFI. This dynamic approach replaces static predefined permissions, enabling real-time flexibility while maintaining reliable access control enforcement across all file copies.
Solution Approach 2:
The UFI serves multiple functions: it identifies the file, tracks copies, and links to access control policies in the database. This universal identifier enables the system to enforce permissions across multiple file copies simultaneously and to apply permission changes universally to all copies. The UFI's multi-functionality resolves the contradiction by providing both reliable enforcement and flexible updates.
3Reliability
If files are encrypted with individual keys for each user, then security is improved, but key management complexity increases and file sharing becomes more difficult
Solution Approach 1:
The patent extracts the access control logic from the encryption key management process. Instead of managing individual keys for each user-file relationship, the system extracts the permission verification function into a separate permission file containing the UFI. The actual decryption key is obtained from the centralized database only after permission is verified, separating key management from access control and reducing complexity.
Solution Approach 2:
The permission file with the UFI acts as an intermediary between the encrypted file and the key management system. This intermediary contains the minimal information needed for access control (the UFI) without exposing the actual decryption keys. The system uses this intermediary to verify permissions through database lookup before releasing the decryption key, simplifying key management while maintaining security.
4Ease of operation
If local permission settings are used on devices where file copies reside, then ease of access is improved, but security is compromised because permission is set locally allowing full owner access
Solution Approach 1:
The patent implements a feedback mechanism where the endpoint device sends the UFI from the permission file to a centralized key store server for permission verification. The server responds with authorization status and decryption keys. This feedback loop ensures that local access attempts are validated against centralized policies, maintaining security while enabling convenient local access operations. The feedback mechanism resolves the contradiction by combining local ease of access with centralized security enforcement.
Data Source
AI summary
A method and system for file content protection and policy-based access control in a networked environment are provided. It includes an endpoint module which runs on endpoint devices and a key store module which runs on key stores servers. The endpoint computing device where files are created and used generates a content encryption key and unique file identifier (UFI), which are different for each file. The file is encrypted with the content key and attaches the UFI to the encrypted file to create a protected file. The coupled UFI and content key are sent to the key store servers to be stored. To accesses the protected file, end point module reads the UFI and sends it to the key store which responses with the permission as the outcome of evaluation of associated policies and the content key if permission is granted so the file can be decrypted.