Wrapped Encryption Key Management via Access Control Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of obtaining and using encryption keys for hosted storage services can be cumbersome for end users, particularly in cloud-based storage systems, where managing access and authorization to encrypted data resources is complex and requires additional user input.
Innovation Solution
A management server in a hosted storage service assigns an encryption key to a data resource, encrypts it, and produces a wrapped encryption key, which is stored in an access control list (ACL). The service automatically verifies user authentication credentials to unwrap the key, allowing authorized users to access the encrypted data resource without additional input, and supports role-specific access privileges and sharing mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual key management processes are used, then users have control over their encryption keys, but the process becomes cumbersome and complex requiring additional user input
Solution Approach 1:
The system automatically manages encryption keys without requiring user intervention. When data is uploaded, the system automatically generates encryption keys, wraps them with user credentials, and stores them in ACLs. During download, the system automatically unwraps keys using stored credentials and provides decrypted data, eliminating the need for users to manually manage keys while maintaining security control.
Solution Approach 2:
The system introduces an intermediary key management layer between the user and the encryption keys. Instead of users directly handling encryption keys, the system acts as a mediator that automatically handles key generation, wrapping with user credentials, storage in ACLs, and unwrapping during data access. This intermediary layer simplifies user interaction while maintaining security.
2Ease of operation
If automatic key unwrapping is implemented, then user access is simplified without additional input, but security verification complexity increases
Solution Approach 1:
The system performs preliminary action by pre-storing user credentials alongside wrapped encryption keys in the ACL structure. This preliminary storage of credential-key associations eliminates the need for real-time authentication verification during data access, as the credentials are already prepared and linked to the keys in advance.
Solution Approach 2:
The system merges the authentication credential verification with the key unwrapping operation. Instead of separate authentication and key retrieval steps, the system combines these operations by storing credentials and keys together in the ACL structure, allowing automatic simultaneous verification and unwrapping in a single operation.
3Reliability
If role-specific encryption keys are used, then access privileges are enhanced, but key management complexity increases
Solution Approach 1:
The system applies local quality by creating role-specific encryption keys with different access privileges for different user groups. Instead of a single uniform key, the system generates distinct keys tailored to specific roles (e.g., administrators vs. regular users), allowing fine-grained control over access privileges while managing complexity through automated ACL-based distribution.
Solution Approach 2:
The system segments the key management function by separating different roles into distinct encryption keys. Each role receives its own dedicated key managed through the ACL system, allowing independent control and management of access privileges for different user groups while the automated system handles the complexity of key distribution and retrieval.
Data Source
AI summary
Methods and systems for managing access to stored data resources assign one or more wrapped (encrypted) encryption keys to each data resource. The resources are encrypted, and the keys may be stored in an access control list (ACL) in association with the encrypted data resources. The keys may be wrapped with metadata that indicates who or what is authorized to use the resource and what role the user or users may have with respect to the resource. The keys may be unwrapped upon receipt of access requests from authorized users, and may be used to decrypt the data resources.