Secure secret recovery

Abstract

The secret is split into multiple encrypted slices. The encrypted slices can be distributed among the members of the group. The encrypted slices enable the secret to be recovered, but require the group authority key to decrypt. Thus, multiple slices are required to recover the secret, but it is still not enough.

Description

TECHNICAL FIELD

[0001] The present invention relates generally to secure secret recovery in data processing systems. BACKGROUND

[0002] Secrets and access controls are used in various computer systems. Secrets can include sensitive data, such as encryption keys, and the like. Secrets are protected in various ways, but two more prominent methods are hashing and encryption. While both involve transforming a secret into an essentially unreadable "ciphertext", hashing is typically one-way (a hashed secret cannot feasibly be recovered, but it can be compared to another hashed secret), while encryption is typically reversible (an encrypted secret can be "decrypted", though typically only using a particular "key", allowing a user in possession of the encryption key to recover the secret). Thus, these methods have different use cases. For example, password systems typically use hashing (a website storing hashed passwords can check whether a user entered their correct password, without ever being able to determine the user's "actual" password), while data that can need to be reused typically utilizes encryption (communications, data storage, and the like).

[0003] There are many different encryption algorithms, but a general commonality between them is the use of one or more "keys". An encryption key is a unique string of data that is used as input to an encryption function; to encrypt a secret, the secret is input into the encryption function along with a unique key, resulting in an encrypted output comprising ciphertext. This ciphertext is essentially randomly appearing, but can be decrypted by inputting the ciphertext and the same encryption key (in "symmetric key" encryption systems) or a different "decryption key" (in "asymmetric key" encryption) into a decryption function (directly related to the encryption function used to encrypt the secret). Typically, an external user can determine which encryption function was used based on experience, and thus, the protection of the encryption key is of utmost importance to the protection of the secret. In some systems, the encryption key itself can be encrypted, typically with a different encryption function (and a different encryption key). Some forms of encryption allow a secret to be decrypted using any of a plurality of predetermined keys. This can be achieved by storing multiple copies of the same secret, each encrypted via a different key.

[0004] Secrets, such as encryption keys, are typically stored securely to prevent their theft. However, this is often accompanied by a tradeoff of reduced fault tolerance; if a secret is stored securely on a single drive, a failure of that drive can render the secret unrecoverable. If the secret is a storage encryption key (controlling encryption of data stored on a storage system), loss of the key can result in loss of data or loss of access to data (which can be functionally the same as loss of the data itself, without the key).

[0005] Many systems have secret backups in an attempt to mitigate this situation, but simple backups have their own tradeoffs; they serve as additional attack vectors. For example, instead of the actual secret, the backup itself can be compromised by an attacker. SUMMARY

[0006] The method according to an aspect of the invention comprises receiving a first encrypted slice from a first key unit and receiving a second encrypted slice from a second key unit. The method further comprises receiving a group authority key from a group authority. The method further comprises decrypting the first encrypted slice and the second encrypted slice using the group authority key. The method further comprises reconstructing a secret based on the first decrypted slice and the second decrypted slice. The method advantageously enables secure recovery of a secret, which requires both multiple slices from multiple key units and a key from a group authority.

[0007] In an embodiment(s) of the invention, the method further comprises generating a first fingerprint of the encrypted first slice and a second fingerprint of the encrypted second slice; sending the first fingerprint and the second fingerprint to the group authority, wherein receiving the group authority key is in response to the group authority verifying the first fingerprint and the second fingerprint. This advantageously provides additional security and verification to the secure secret recovery process by requiring the group authority to verify the slices via the fingerprints (without exposing the slices themselves to the group authority).

[0008] In an embodiment(s) of the invention, the method further comprises splitting the reconstructed secret into a first new slice and a second new slice; encrypting the first new slice and the second new slice; transmitting the encrypted first new slice to the first key unit; and transmitting the encrypted second new slice to the second key unit. This advantageously enables distribution of new slices of the reconstructed secret among the key units, providing further security (e.g., in the event of a component failure, in which case the reconstructed secret can otherwise be lost). Further, the distributed slices are encrypted again, further improving security over the prior art.

[0009] In an embodiment(s) of the invention, the method comprises obtaining a secret; receiving a group authority key from a group authority; and based on the group authority key, generating multiple encrypted slices of the secret. This advantageously enables establishment of a system in which a securely stored secret can be reconstructed.

[0010] Another aspect of the application provides a computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform any of the methods discussed above and claimed below. This advantageously enables secure recovery of a secret, which requires both multiple slices from multiple key units and a key from a group authority.

[0011] Another aspect of the application provides a system comprising a memory and a central processing unit (CPU). The CPU is configured to execute instructions to perform any of the methods discussed above and claimed below. This advantageously enables secure recovery of a secret, which requires both multiple slices from multiple key units and a key from a group authority.

[0012] The above summary of the application is not intended to describe each illustrated embodiment or every implementation of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings included in the present application are incorporated into and form part of the specification. They illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure. The drawings merely illustrate certain embodiments and are not intended to limit the present disclosure. As the following detailed description makes clear, features and advantages of the claimed subject matter will become apparent from the following detailed description, when considered in light of the drawings, in which like numerals designate like parts and in which:

[0014] Figure 1 is a block diagram illustrating a secure secret reconstruction system in accordance with several embodiments of the present disclosure.

[0015] Figure 2 is a high level secure secret key reconstruction method using a "split then encrypt" approach in accordance with several embodiments of the present disclosure.

[0016] Figure 3 is an example secure secret key reconstruction method from the perspective of a group authority in accordance with several embodiments of the present disclosure.

[0017] Figure 4 is an example secure secret key reconstruction method from the perspective of a replacement key unit in accordance with several embodiments of the present disclosure.

[0018] Figure 5 is a high level secure secret key operation method in accordance with several embodiments of the present disclosure.

[0019] Figure 6 is a block diagram illustrating in greater detail a system comprising an example key unit comprising multiple key access control units and storing a key in accordance with several embodiments of the present disclosure.

[0020] Figure 7 is a high-security secret key reconstruction method using a "encrypt-then- split" approach according to several embodiments of the present disclosure.

[0021] Figure 8 A cloud computing environment according to embodiments of the present disclosure is depicted.

[0022] Figure 9 An abstraction model layer according to embodiments of the present disclosure is depicted.

[0023] Figure 10 A high-level block diagram of an example computer system that can be used for implementing embodiments of the present disclosure is shown.

[0024] While the application can be susceptible to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and will be described in detail herein. However, it should be understood that the intention is not to limit the application to the particular embodiments described. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the scope of the application. DETAILED DESCRIPTION

[0025] Aspects of the present disclosure relate to systems and methods for securely recovering a secret key. More particular aspects relate to a system to determine that a key unit comprising a secret key has failed, to use components stored in other key units to reconstruct the secret key, and to enable a replacement key unit to decrypt the reconstructed secret key.

[0026] Systems and methods according to the present disclosure advantageously improve fault tolerance while minimizing security costs. In essence, a secret can be stored in an encrypted state, and instead of utilizing a complete backup of the secret, the secret is "split" (divided or segmented) into "slices" (portions or segments), each encrypted and stored by a separate "key unit." The encrypted slices cannot (feasibly) be decrypted without a key provided by a group authority supervising the various key units. In this way, in the event of a key unit storing the secret failing, the secret can be recovered with minimal security risk. This provides several advantages. For example, if a key unit storing a storage encryption key fails, the storage system can not need to fully reconstruct from a backup (a process that can take weeks or more for larger storage systems); instead, a system according to the present disclosure can reconstruct the "missing" storage encryption key and regain useful control over the storage system and its data. Further, all of this can be done without risking exposure of the storage key to other key units or even the group authority, so that, once reconstructed, it can not need to (immediately) change.

[0027] In this disclosure, the term "key" is used, such as "stored key," "group access key," and "user key." These names are used for illustrative purposes only; as those skilled in the art will understand, keys can be used for other purposes. In particular, "stored key" is used only as an example of a "securely stored secret" that can be securely recovered through this disclosure. Other possible examples include communication keys, sensitive data, etc. Similarly, the term "key unit" is used as an illustrative example; however, the same concept can be more broadly referred to simply as "unit."

[0028] In this disclosure, the term "slice" is used. Specifically, a secret slice (such as a storage key) can be encrypted and distributed among units of a group. A slice described as "stored" in a unit is stored in an encrypted state in the unit's slice storage device. The slice is encrypted by the unit performing the initial slicing. The slice is encrypted using a special encryption key provided by the group's authorizing authority.

[0029] While most examples of this disclosure involve each unit storing a single encrypted slice of the secret, in some embodiments, a unit may store multiple slices. For example, in a group of four units, the secret S of the first unit may be divided into slices s1, s2, and s3. In some embodiments, a second unit may store slice s1, a third unit may store slice s2, and a fourth unit may store s3, such that if the first unit fails, the replacement unit can still receive all slices and therefore (assuming other conditions described below are met) the secret S can be recovered. However, in some embodiments, a second unit may store slices s1 and s2, a third unit may store s2 and s3, and a fourth unit may store s3 and s1. In this way, each slice is stored in at least two units, so if, for example, both the first and second units fail, all slices can still be recovered, and therefore the secret S can still be reconstructed. This can provide redundancy in some systems, further advantageously improving fault tolerance. Additionally, this can make it possible to determine whether a unit has been compromised or otherwise corrupted by a malicious actor, as slices can be compared to determine whether the slices of a single unit are different from “copies” of those slices stored on other units.

[0030] The secret slice can be distributed among the cells to enable the reconstruction of the secret regardless of which cell fails (or possibly, depending on the embodiment, even if multiple cells fail). In some embodiments, the cells may also store parity data to enable the verification of the stored slice.

[0031] The secret can initially be obtained from the system operator (e.g., a technician who installs the key unit), from hardware (e.g., which may be randomly generated), etc. In some embodiments, the secret can be derived from information from a group authorizing authority. When the secret needs to be reconstructed, a new unit (typically referred to herein as a "replacement key unit") can be added to the group. When a new unit is added, the group authorizing authority can verify its identity (e.g., via certificate exchange / checking). After proving its identity to the group authorizing authority, the new unit can receive slices of the secret from the remaining units. Because the slices are encrypted by a different unit than the unit that stores them (and uses a key controlled by the group authorizing authority), the unit storing the slices may not be able to decrypt them.

[0032] In some embodiments, key units can be organized into "groups," each group containing a set of n key units (where n >= 1). For example, a group authorizing authority can create a group of n key units before system operation. Each group can be managed by a different group authorizing authority, for example... Figure 1 The GA110, although in some embodiments, a group authority can manage more than one group. However, for ease of explanation, only a single key unit group is described in detail herein. It is beneficial for the GA to act as a PKI certificate authority to facilitate the identification of components of the authentication system. The GA can determine which set of key units belongs to a particular group and can facilitate this by creating certificates of group membership. The key units can then join the group. It is beneficial to prove that the key units function correctly according to the requirements of secure secret recovery. This can be done by the manufacturer using serial numbers, certificates, signing codes, etc. This can help prevent malicious actors from joining the group (via “fraudulent” key units). For example, in some embodiments, a list identifying key units (possibly as a blockchain) can be provided to the GA, and the GA can check to see if a key unit matches the list. In some embodiments, more than one group authority can share control over a group.

[0033] In this disclosure, communication between reference units, users, group authorization authorities, etc., such as a group authorization authority sending a group authorization key to a key unit, is described. Transmission encryption can be used in a manner familiar to those skilled in the art to enhance message security.

[0034] Figure 1A high-level block diagram of an example recoverable security secret system 100 according to several embodiments of the present disclosure is shown. System 100 includes: a group authorization authority (GA) 110, key units including key units U1 121, key units U2 122, and key units U3 123 (collectively referred to as "key units 121-123"), and storage units including storage units 107, storage units 108, and storage units 109 (collectively referred to as "storage units 107-109"). GA 110 is responsible for determining the configuration of the entire system. GA 110 includes a set of GA keys 101, 102, and 103 for protecting information in the key units (as described in further detail below). GA 110 also includes a fingerprint storage device 114.

[0035] Storage units 107-109 store data encrypted using keys kept secret from users 104-106 and GA 110. Storage encryption keys 141, 142, and 143 (collectively referred to as "Storage Encryption Keys 141-143" or "Storage Keys 141-143") are stored in key units 121-123. A particular storage encryption key may be stored in only one key unit. Furthermore, key units 121-123 may be configured such that storage encryption keys 141-143 cannot be retrieved from key units 121-123 (e.g., a given storage encryption key may not be readable by any entity other than the key unit where it is stored). Storage encryption keys 141-143 are stored in an encrypted state in key access control units 131-133.

[0036] Storage keys 141-143 can be encrypted with different user keys to ensure that a single user key ( Figure 1 (Not shown) It may be possible to decrypt only one storage key. For example, storage key 141 may be encrypted with a first user key and stored in key access control unit 131, storage key 142 may be encrypted with a second user key and stored in key access control unit 132, storage key 143 may be encrypted with a third user key and stored in key access control unit 133, and so on.

[0037] In some embodiments, each user of system 100 is provided with one or more "user keys" configured to decrypt a specific stored key, as will be referenced below. Figure 5 and Figure 6 Further detailed description.

[0038] As shown in the figure, each of the key units 121-123 stores a key access control unit 131-133. However, in Figure 1In some embodiments not shown, some key units may include multiple key access control units, each storing a stored key. This can be particularly advantageous for providing a specific user with more granular access to a specific stored key. This will be referred to below. Figure 5 and Figure 6 Further detailed description.

[0039] Key units 121-123 also include key slice storage devices 161-163, enabling the key unit to store slices of stored keys from other key units. For example, key slice storage device 161 enables key unit 121 to store slices 172 and 183 of stored keys 142 and 143, respectively. Similarly, key storage device 162 enables key unit 121 to store slices 173 and 181 of stored keys 143 and 141, respectively, while key storage device 163 enables key unit 123 to store slices 182 and 171 of keys 142 and 141, respectively. During the process of creating a key unit (e.g., key unit 121) with a stored key (e.g., stored key 141), the key unit can slice the stored key into two or more slices (such as slices 171 and 181) via a splitting / reconstruction function. The key unit can then encrypt the slices using one or more group permission keys (e.g., GA keys 101-103). In some embodiments, each slice is encrypted with a different GA key. Once the slice is encrypted, the key unit can generate a fingerprint of the encrypted slice. The key unit can then send the fingerprint to the group authorization authority for storage in the fingerprint storage device 114.

[0040] In some embodiments, the key unit may store key slices in a storage unit. For example, key unit 121 may store key slices 172 and 183 in storage device 107. When storing key slices, the key unit may encrypt them using a storage key held by the key unit (e.g., key unit 121 may use storage key 141 to encrypt key slices 172 and 183 and store them in storage device 107).

[0041] The key is divided into m slices (where m < n (and n = the number of units in the group)) by a reconstruction function, the slices are encrypted, and the encrypted slices are sent to different key units, so that the stored key can be recovered (e.g., from a failed key unit). One or more of one or more GA keys (such as GA keys 101-103) provided by GA 110 can be used to encrypt the slices. For example, in some embodiments, each key unit divides its stored key into m slices, encrypts each slice, and sends one slice to each of the other key units. Thus, each key unit can receive m encrypted slices (each slice is a slice of a different key). In some embodiments, a key unit may include more than one stored key, and therefore m slices can be sent for each stored key (therefore, some key units can receive more than m slices).

[0042] In some embodiments, the GA key sent to each key unit is different. Using the GA key means that m slices must be available, but not enough to recover the secret key. This advantageously improves the security of system 100 relative to prior art (such as Shamir's secret sharing, which only requires a quorum) by reducing the risk of a malicious actor compromising the key unit and spontaneously recovering the key outside of the "key unit failure" scenario; even if a key unit is able to obtain m slices of the key, it will not be able to decrypt the slices (and thus recover the key) without the correct GA key(s) from the GA. Therefore, even if an actor can access a GA key (such as the compromised key unit previously used to encrypt its own slice), it will still not be able to reconstruct the key without the remaining GA key.

[0043] In some embodiments, GA 110 provides a different GA key for each slice. For example, if m = 2, GA 110 may provide key 101 for the first slice 171 and key 102 for the second slice 181. The number of slices m may depend on the number of key units n in the group and the properties of the erasure or error correction codes used to protect the slices. In some embodiments, parity checking may be included to verify the integrity of the slices.

[0044] For example, a key set may include n = 5 key units, where the stored key w is recoverable in the event of the loss of additional key units (e.g., one of the 5 key units may have failed). Therefore, the code may have m = 3 slices and a parity check computed from these slices to produce code with n-1 elements. Since the slices are encrypted with a set of keys from the GA110 that are not available to the remaining key units, the secret is not held by the m slices but is protected by authorized units (such as replacement key units added to replace failed key units). Furthermore, one or more keys from the GA 110 will be needed to recover the secret key.

[0045] As an example, after a new secret key 141 is encoded in key unit 121, the group authorization authority GA 110 can pass GA keys 101-103 to key unit 121. The reconstruction function 116 of key unit 121 can segment the stored key 141, encrypt each segment with different GA keys from GA keys 101-103, and then calculate a fingerprint for each such encrypted segment. These fingerprints can be returned to GA 110 and stored in fingerprint storage device 114. The encrypted segments can then be sent to other key units 122 and 123. For example, key unit 122 can receive encrypted segment 171, while key unit 123 can receive encrypted segment 181. The key units can also utilize the reconstruction function to perform erasure / error correction encoding and segment allocation.

[0046] During a recovery operation (e.g., if key unit 121 fails, causing the storage key 141 to be lost), GA110 can request a replacement key unit. Figure 1 (Not shown) Before sending the GA key required to decrypt the slice, it proves that it has all the key slices needed to reconstruct the stored key 141. This can be performed by the replacement key unit receiving the encrypted key slices 171 and 181 from key units 122 and 123, respectively. The replacement key unit can then verify the slices (via the fingerprint compared to the fingerprint storage device 114 by GA 110), and then GA 110 can send the GA key required to decrypt slices 171 and 181 to the replacement key unit. After receiving the key, the replacement key unit can decrypt the slice and reconstruct the secret key 141.

[0047] In some embodiments, instead of splitting the key and then encrypting the slices, the key is encrypted (and fingerprinted) before being split. For example, in some embodiments, key unit 121 may receive GA key 101, encrypt storage key 141 with GA key 101, generate a fingerprint of the encrypted key (via, for example, a hash function), and send the fingerprint to GA 110. GA 110 may store the fingerprint of the encrypted key, and then key unit 121 may split the encrypted key into slices 171 and 181, distributing them to key units 123 and 122, respectively. When reconstructing the key, replacement key unit may receive the encrypted slices, reassemble them into the encrypted key, generate a verification fingerprint of the encrypted key, and send that fingerprint to GA 110. GA 110 may verify the fingerprint and return the appropriate GA key 101, thereby allowing replacement key unit to decrypt and recover the key. This reduces the complexity of system 100 and reduces storage overhead (because GA 110 only needs to store one fingerprint of the entire encrypted key, rather than fingerprints of each encrypted slice).

[0048] Figure 2 This is an advanced secure secret key reconstruction method 200 using a "segmentation and then encryption" method according to several embodiments of the present disclosure. Method 200 can be provided by a system configured to enable secure secret key reconstruction (e.g., Figure 1 The method 200 is executed by system 100. Method 200 can be executed in response to key unit failure, initiation of auditing, etc. Method 200 includes receiving an encrypted slice of the key at operation 202. Operation 202 can be performed, for example, by replacing the key unit. Operation 202 may include receiving an encrypted slice of the secret key from other key units in the system. In some embodiments, operation 202 may also include receiving one or more parity keys from key units in the system. In some embodiments, operation 202 may include one slice from each slice in which the secret key is received. In some embodiments, operation 202 may include all slices except one slice in which the secret key is received, along with the parity keys, thereby enabling the reconstruction of missing slices.

[0049] Method 200 further includes verifying the slice at operation 204. Operation 204 may include, for example, generating a fingerprint of the encrypted slice and comparing the fingerprint with a stored fingerprint. For example, the key unit may utilize a hash function (such as a secure hash algorithm (SHA)-256) or generate a checksum. The key unit may generate the fingerprint and send it to a group authorization authority. In some embodiments, the group authorization authority may compare the received fingerprint with a stored fingerprint to determine whether the encrypted slice is valid. While this disclosure focuses on the use of fingerprint verification, other techniques for proving possession of secrets, including "zero-knowledge" proofs, may also be used.

[0050] Method 200 further includes decrypting the slice at operation 206. Operation 206 may include, for example, decrypting the slice using one or more group authorization keys. Once the group authorization authority confirms that the fingerprint of the encrypted slice is valid, the group authorization key may be sent by the group authorization authority to the key unit (e.g., after operation 204). Once the group authorization key is received, the key unit uses the group authorization key to decrypt the slice. In some embodiments, a different group authorization key may be used for each slice. In some embodiments, a single group authorization key may be used for multiple (or even all) slices.

[0051] Method 200 further includes reconstructing the key at operation 208. Operation 208 can be performed by a replacement key unit. The replacement key unit can input a decrypted slice of the stored key into the reconstruction function and receive the stored key in response. Note that the unencrypted stored key may not be output / returned to or accessed by an entity outside the key unit reconstructing the stored key.

[0052] Upon completion of operation 208, the storage key has been reconstructed and is ready for storage operations without requiring the storage unit to be rebuilt. This advantageously reduces downtime that could otherwise result from a failure of the key unit. Operations 210 and 212 enable the system to prepare for subsequent recovery (e.g., in the event that the replacement unit itself later fails). Notably, this reconstruction of the storage key allows information stored in the storage unit to be protected while being encrypted with the storage key. Therefore, the reconstructed data will be encrypted with the storage key, thus remaining secure. Reconstructing data through other means would require protection (e.g., RAID) to access unencrypted data, which is generally less secure.

[0053] Method 200 further includes allocating a new slice of the newly reconstructed storage key at operation 210. Operation 210 may be performed by a replacement key unit. Operation 210 may include, for example, splitting the storage key into multiple slices. The number of slices (m) may be based on the number of key units (n) in the group. For example, in some embodiments, m = n-1; however, in some embodiments, the key may be split into fewer slices, wherein slices are sent to more than one key unit (advantageously enhancing redundancy). The group authorizing authority may generate a new set of group authorization keys and send the new GA keys to the replacement key unit. The key unit may then use the new GA keys(one or more) to encrypt the new slices. In some embodiments, each slice may be encrypted using a different GA key. In some embodiments, a GA key may be used for more than one slice. Once all slices have been encrypted, the replacement key unit may transfer the encrypted slices to the other key units in the group. The new encrypted slices may be stored in the slice storage devices of the other key units, replacing the slices received at operation 202.

[0054] Method 200 further includes updating the fingerprint based on the new slice at operation 212. Operation 212 may include, for example, generating a fingerprint of the new encrypted slice using a key unit. Operation 212 also includes sending the fingerprint to a group authorization authority. The group authorization authority stores the new fingerprint in a fingerprint storage unit, replacing the previously stored fingerprint checked at operation 204.

[0055] In some embodiments, the order of operations 204-208 may be different; for example, in Figure 2 The sequence described can be used with a "slice then encrypt" scheme. However, in some embodiments, the key can be encrypted before it is sliced ​​(referred to as an "encrypt then slice" embodiment). In such embodiments, the verification fingerprint can be generated based on the entire encryption key rather than on each individual slice. For example, in some embodiments, after receiving the encrypted slice at operation 202, the slice can be assembled into a (still encrypted) key, a fingerprint of the encryption key can be generated and verified, and the key can be decrypted using a group permission key. In such embodiments, operation 210 may include encrypting the recovered key with a new GA key, and then slicing and distributing the newly encrypted key. See below for reference. Figure 7 The advanced example encryption is described, and then the implementation is segmented. Figure 2 A system-level flowchart of secure secret key reconstruction operations is depicted. Figure 3 and Figure 4 More detailed flowcharts are provided for the operations performed by the group authorization authority and the replacement key unit, respectively.

[0056] Figure 3This is an example of a secure secret key reconstruction method 300 from the perspective of a group licensing authority, based on several embodiments of this disclosure. Method 300 can be provided by a group licensing authority (e.g., Figure 1 The method is executed by GA 110. Method 300 includes detecting a faulty key unit at operation 302. Operation 302 may include, for example, determining that the key unit is no longer responding, receiving an indicator that the key unit has failed, etc. Key units communicate with each other and may use techniques such as heartbeat detection to see if other units remain responsive. Typically, temporary power outages occur, and these should be distinguished from genuine failures. Consensus means that a subset of units (which may include the GA and any users) determine that they have been unable to reach the key unit for a period of time. In some embodiments, the operator may be notified to verify whether the problem is related to the key unit or elsewhere. In some embodiments, if the remaining units agree, the group accreditation body may simply consider the unit "failed".

[0057] Method 300 further includes initiating key reconstruction at operation 304. Operation 304 may include, for example, identifying a replacement key unit and sending a signal to the key unit group instructing the replacement key unit to reconstruct the faulty key unit. In some embodiments, the replacement key unit may be manually installed, for example, by a technician. In some embodiments, the key unit group may include a "dormant" or "backup" replacement key unit, in which case operation 304 may include waking up or otherwise activating the backup replacement key unit. The initialization of operation 304 enables the replacement key unit to request and receive cryptographic key slices from other active key units, as will be referred to below. Figure 4 Method 400 is discussed in further detail.

[0058] Method 300 further includes receiving fingerprints of cryptographic key slices at operation 306. These fingerprints may be received from, for example, a replacement key unit. In some embodiments, operation 306 includes receiving the fingerprint of each cryptographic slice of the key to be reconstructed. In some embodiments, these slices may be combined prior to decryption, and operation 306 includes receiving a single fingerprint of the cryptographic key.

[0059] Method 300 further includes determining at operation 308 whether the received fingerprint matches a fingerprint stored by a group authorization authority. For example, the group authorization authority can do so in a fingerprint storage device (e.g., Figure 1 A set of verification fingerprints is maintained in the fingerprint storage device 114. Determining whether the fingerprints match at operation 308 allows the group authorization authority to determine whether the replacement key unit has acquired all slices and whether the replacement key unit has any expired or otherwise corrupted slices. This can be useful in detecting fraudulent key reconstruction requests.

[0060] The group authorization authority performing method 300 may store multiple fingerprints. For example, in some embodiments, the fingerprint storage device of the group authorization authority may include the fingerprint of each slice of each stored key in the group. The fingerprint storage device may further include data structures or other means for mapping which fingerprint corresponds to which slice of which key, as will be understood by those skilled in the art.

[0061] If the fingerprint received at operation 306 does not match the stored fingerprint (308 "No"), the group authorization authority performing method 300 may return an error at operation 310. In some embodiments, operation 310 may further include generating an alarm signal or otherwise indicating that the reconstruction attempt failed due to the slice fingerprint mismatch.

[0062] If the fingerprint received at operation 306 matches the fingerprint stored in the GA (308 "Yes"), method 300 further includes transferring the group authorization key to the replacement key unit at operation 312. Operation 312 may include identifying or otherwise selecting the GA key (stored by the group authorization authority) required to decrypt the encrypted slice. For example, in some embodiments, each slice may be encrypted with only a different GA key. Transferring the appropriate key enables the replacement key unit to decrypt the slice and thus reconstruct the stored key of the faulty key unit. Notably, the stored key is reconstructed by its replacement key holder without any other entity (e.g., group authorization authority, user, another key unit, etc.) accessing the stored key itself. Furthermore, the key cannot be reconstructed without both the slice from another key unit and the key from the group authorization authority, which advantageously increases security.

[0063] Method 300 further includes generating a new GA key at operation 314. Operation 314 enables the encryption of newly generated slices that store the key, resulting in new, unique encrypted slices (which can then be assigned to other key units by the replacement key unit). Similar to the previous key, the group authorizing authority can generate a new GA key for each slice. Method 300 further includes transmitting the new GA key to the replacement key unit at operation 316.

[0064] When the replacement key unit receives a new GA key, it is able to encrypt the new slice and thus generate a new fingerprint for the encrypted slice. Method 300 may further include receiving and storing the fingerprint of the new encrypted key slice at operation 318. Operation 318 may include receiving the fingerprint from the replacement key unit and storing the fingerprint in a fingerprint storage device of a group authorizing authority. In some embodiments, the group authorizing authority may overwrite a pre-existing fingerprint associated with a stored key reconstructed by the replacement key unit.

[0065] Figure 4This is an example of a secure secret key reconstruction method 400 from the perspective of replacing a key unit, according to several embodiments of this disclosure. Figure 4 As shown, method 400 can be an example of a "segmentation and then encryption" mechanism, but it can also be modified to implement an "encryption and then segmentation" embodiment. Method 400 can be performed by a replacement key unit included in or added to a key unit group. The replacement key unit can be similar to... Figure 1 One of the key units 121-123, and can be added or otherwise activated in the event of a failure of an existing key unit. Method 400 includes, at operation 402, obtaining from a group authorization authority (e.g., Figure 1 The GA 110 receives instructions to reconstruct the key. The GA can respond to the detection that a key unit of the group has failed (as per reference). Figure 5 (As discussed) and send these instructions.

[0066] Method 400 further includes receiving, at operation 404, an encrypted slice of a secure secret key from other key units. Operation 404 may include, for example, requesting a slice corresponding to the lost key (of the failed key unit) from each remaining key unit in the group. For example, if Figure 1 If unit 122 fails (loses access to storage key 142), then the key unit is replaced. Figure 1 (Not shown) can request a slice of key 142 from units 121 and 123. The replacement key unit can then receive encrypted key slice 172 from key unit 121 and encrypted key slice 182 from key unit 123. In some embodiments, operation 404 may further include receiving one or more parity keys, which enable the replacement key unit to generate the missing encrypted key slice.

[0067] Method 400 further includes transmitting the fingerprint of the cryptographic key slice to the group authorization authority at operation 406. Operation 406 may include, for example, generating the fingerprint of the key slice received at operation 404. A reconstruction function that replaces the key unit (similar to...) can be used. Figure 1 The reconstruction functions 116, 118, and 120 generate fingerprints. Once generated, the fingerprints can be transmitted to a group authorization authority, such as GA 110. This allows the group authorization authority to compare the fingerprints with stored fingerprints to verify that the replacement key unit has the appropriate slice.

[0068] Method 400 further includes receiving one or more group authorization keys from a group authorization authority at operation 408. In some embodiments, the replacement key unit may receive a GA key for each slice. In some embodiments, GA keys for more than one slice may be received. If the fingerprint sent at operation 406 does not match the fingerprint in the fingerprint storage device of the GA, the GA may refuse to transmit the GA key, and reconstruction may fail. Depending on the embodiment, the drive can still be reconstructed using conventional methods. However, this may require a protection / backup system (e.g., RAID) to perform calculations on unencrypted data, which is generally considered less secure.

[0069] Method 400 further includes decrypting the slice with the group authorization key at operation 410 and reconstructing the storage key. Operation 410 can be performed by the reconstruction function of the replacement key unit. The group authorization authority can specify which GA key will be used with which encrypted slice. Once the slices are decrypted, they can be reassembled into the original storage key. Once the storage key is reconstructed, the storage unit associated with the storage key can be accessed, and normal operation can be resumed. However, operations 412-420 further enable the system to recover from potential future failures of the replacement key unit by establishing new slices and fingerprints.

[0070] Method 400 further includes receiving a replacement GA key from the GA at operation 412. Once the storage key has been reconstructed, the GA can generate new encryption keys to be used to encrypt slices of the storage key in a new manner. These new GA keys are then sent to the replacement key unit.

[0071] Method 400 further includes generating a new slice of the reconstructed key at operation 414. Operation 414 can be performed by a reconstruction function that replaces the key unit.

[0072] Once the replacement GA key has been received (operation 412) and a new slice has been generated (operation 414), method 400 further includes encrypting the new slice using the replacement GA key at operation 416. The new GA key enables the replacement key unit to encrypt the slice in a different manner than the previous slice (i.e., the slice received at operation 404). Operation 416 can also be performed by the reconstruction function of the replacement key unit.

[0073] Method 400 further includes transmitting the fingerprint of the new (encrypted) slice to the group authorizing authority at operation 418. Operation 418 may include, for example, using a reconstruction function that replaces the key unit to generate the fingerprint of the encrypted slice and transmitting the fingerprint to the group authorizing authority. The GA can replace the previously stored fingerprint with the newly generated fingerprint.

[0074] Method 400 further includes transmitting a new cryptographic slice to other key units at operation 420. If there are more other key units than the slice, operation 420 may further include selecting the key unit to which the slice is to be sent. In some embodiments, operation 420 may include transmitting the slice to a replacement key unit (at operation 404) from which the key unit received the previous slice. This can advantageously allow the allocation of key slices to remain relatively constant.

[0075] It is worth noting that a failed key unit may already contain slices of other keys stored on other key units. Therefore, when recovering a failed key by replacing a key unit, the keys of the other key units can be re-sliced ​​and re-encrypted (in either order, depending on whether the system is implementing a "slice-and-encrypt" or "encrypt-and-slice" approach), and the encrypted slices can be redistributed. In some embodiments, all stored slices on all key units in the group can be replaced in this manner. In some embodiments, only the slices stored by the failed key unit can be regenerated and sent to the replacement key unit. To achieve this, the key units of the group can utilize the same slicing arrangement ("symmetric arrangement"). Therefore, if a first unit is notified that a second unit has failed, the first unit can determine which of its key slices are stored by the second unit. In an asymmetric arrangement, the group authorizing authority can track this information.

[0076] In some embodiments, before transmitting a new encrypted slice, the key unit may calculate a cyclic redundancy check (CRC) for each slice and transmit it along with the slice itself. When a slice is received, the CRC can be recalculated and checked to detect whether the slice has become corrupted.

[0077] In some embodiments, instead of (or in addition to) the key unit generating a new slice (operation 414), the key unit may add other information, such as a timestamp, sequence number, or random number, to the "old" slice (i.e., the slice decrypted at operation 410). Once encrypted and fingerprinted (operations 416 and 418), the additional information will make the fingerprint unique. This provides security against attackers attempting to "collect" old slices over time and eventually be able to reconstruct the key (because the old slices will still have different fingerprints due to the additional information). This provides additional security and allows the system to securely reuse old slices instead of generating new ones upon recovery.

[0078] In some embodiments, some operations of method 400 may be performed in a different order. For example, instead of encrypting the slices after splitting the key (e.g., in operations 414-416), the system may encrypt the key and then split the encrypted key.

[0079] Figure 5 This is a highly secure secret key manipulation method 500 according to several embodiments of the present disclosure. Method 500 describes, for example... Figure 1 The general operation of system 100. Method 500 can be performed by a key unit that communicates with the user and storage device or system. For example, method 500 can be performed by key unit 121 (communicating with user and storage system 107).

[0080] Method 500 includes receiving a request and a user key from a user at operation 502. While method 500 describes reading data from a storage system, as those skilled in the art will understand, method 500 can be modified to enable writing data to a storage device. Operation 502 may include, for example, receiving a read request relating to data stored in the storage system. The key unit also receives the user key to decrypt (in an encrypted state) a stored key stored within the key unit. Operation 502 may also include performing an authentication process (typically as part of establishing a secure communication link).

[0081] Method 500 further includes determining at operation 504 whether the user key is able to obtain access to the key unit using the key (e.g., by decrypting the storage key). If the user key does not decrypt the storage key, the user may be unable to access the storage key (504 "No"), causing the request to be rejected at operation 506. Operation 506 may include returning an error message to the requesting user. The error message may indicate that the user cannot access the storage system or the storage key.

[0082] If the user key is able to decrypt the storage key (504 "Yes"), then method 500 further includes retrieving the requested data (in an encrypted state) from the storage device at operation 508. Then, at operation 510, the storage key is decrypted via the user key, and at operation 512, the retrieved data is decrypted using the decrypted storage key. Method 500 further includes transferring the requested data to the user in response to the request at operation 514.

[0083] In some embodiments, the group authorizing authority can verify the storage key by generating a test data block and storing it on a storage device (via modified method 500), or by encrypting the storage key with a storage key (or by encrypting the storage key with a test key generated using a verification key stored by the group authorizing authority or by a key unit holding the storage key being tested). A fingerprint of the data can be stored in the group authorizing authority's fingerprint storage device. At a later time, the group authorizing authority can have the key unit decrypt the data, generate a new fingerprint, and transmit the new fingerprint to the group authorizing authority. If the fingerprints do not match, the storage key may have been changed. This can be particularly advantageous for verifying whether the reconstruction was successful.

[0084] Figure 6 The following is a block diagram of a system 600 including an example key unit 621 according to several embodiments of the present disclosure, with additional details. The key unit 621 includes a plurality of key access control units 631, 632, 633, 634, and 635, and storage keys 641 and 642. The key unit 621 may be a larger group of key units (…). Figure 6 (Not shown in the image) Figure 6 User 601 (with user key 611), user 602 (with user key 612), and user 603 (with user key 613) are also shown. Essentially, to enable multiple users to access the same stored key, key unit 621 may include multiple copies of the stored key, each encrypted using a different key. In this way, multiple users (each with their own user key) can be allowed to access the same key without compromising security regarding how the key is stored.

[0085] If a user wishes to access storage device 608, they submit their user key to key unit 621. The user key is then submitted to the encryption / decryption function of a key access control unit (represented as padlocks 651, 652, and 653). For example, encryption / decryption function 651 of key access control unit 631 can decrypt using user key 611, while encryption / decryption function 652 of key access control unit 632 can decrypt using user key 612. It is noteworthy that both key access control units 631 and 632 store encrypted copies of the same storage key 641. These copies are encrypted differently, such that, for example, user key 611 cannot access key access control unit 632 (because user key 611 can only decrypt padlock 651).

[0086] Furthermore, the key access control unit 633 may include a different but encrypted stored key 642 (padlock 651) that can be decrypted by the user key 611. Similarly, the key access control unit 634 may include a second encrypted copy of the stored key 642 encrypted via 652, and the key access control unit 635 may include a third encrypted copy of the stored key 642 encrypted via 653, decryptable via the user key 613. This could mean, for example, that two users could access the stored key 641, while three users could access the stored key 642.

[0087] Key unit 621 also includes slice storage device 660, which in Figure 6The diagram is shown as multiple slices (collectively referred to as "slices 661-664") comprising different keys 661, 662, 663, and 664. Slices 661-664 may correspond to slices of different keys securely stored from other key units within the same group. Slices 661-664 are stored in an encrypted state and may be sent to a replacement key unit upon request from a group authorizing authority.

[0088] Key unit 621 is connected to storage system 608, which includes one or more storage devices. Data sent to and received from storage system 608 can be encrypted / decrypted via storage key 641 or 642.

[0089] When key unit 621 is initially initialized, stored keys 641 and 642 are segmented via a reconstruction function. The slices can then be used with a group authorization authority ( Figure 6 (Not shown) One or more group permission keys are received to be encrypted, and are assigned to other key units in the group ( Figure 6 (Not shown in the image) between the two locations for secure storage.

[0090] Figure 7 This is an advanced secure secret key reconstruction method 700 using an "encryption-then-splitting" approach according to several embodiments of this disclosure. Method 700 can be provided by a system configured to enable secure secret reconstruction (e.g., Figure 1 The method 700 can be executed in response to a key unit failure, auditing being initiated, etc. Method 700 includes receiving an encrypted slice of the key at operation 702. Operation 702 can be performed, for example, by replacing the key unit. Operation 702 may include receiving an encrypted slice of the secret key from a key group or other key units in the system. In some embodiments, operation 702 may also include receiving one or more parity keys from key units in the system. In some embodiments, operation 702 may include one slice from each slice in which the secret key is received. In some embodiments, operation 702 may include all but one slice in which the secret key is received, along with the parity keys, thereby enabling the reconstruction of missing slices.

[0091] Method 700 further includes assembling the encrypted slices into an encrypted key at operation 704. Operation 704 may include, for example, reading one or more tags on each slice to determine the proper order in which the slices are arranged to be assembled into the encrypted key. It is worth noting that while the key unit may be able to assemble the encrypted key, it will not be able to decrypt (and therefore recover) the key without the appropriate group authorization key. The group authorization authority may require the key unit to prove that the encrypted key it has assembled is the correct key.

[0092] Method 700 further includes verifying a fingerprint of the encryption key at operation 706. Operation 706 may include, for example, generating a fingerprint of the encryption key and comparing that fingerprint with a stored fingerprint. For example, the key unit may utilize a hash function (such as a secure hash algorithm (SHA)-256) or generate a checksum. The key unit may generate a fingerprint and send the fingerprint to a group authorizing authority. In some embodiments, the group authorizing authority may compare the received fingerprint with a stored fingerprint to determine whether the encryption key is valid (e.g., to confirm whether the reassembled encryption key is the same as the previously segmented encryption key being reconstructed). Notably, the encryption key itself may not be sent to the group authorizing authority; instead, it only receives the hash of the encryption key. In this way, even the group authorizing authority cannot obtain the key.

[0093] Method 700 further includes decrypting the key at operation 708. Operation 708 may include, for example, using a group authorization key to decrypt the assembled encryption key. Once the group authorization authority confirms that the fingerprint of the encryption key is valid (e.g., after operation 706), the group authorization authority may send the group authorization key to the key unit. Upon receiving the group authorization key, the key unit then uses the group authorization key to decrypt the key. It is worth noting that the group authorization authority may include (or be able to generate / obtain) multiple different group authorization keys; the key unit may only use the appropriate key to decrypt the key. The group authorization authority may determine which key (if any) to send to the key unit based on, for example, the result of a fingerprint comparison (the stored fingerprint can be used as an index to the group key array), a specific request (the key unit may explicitly state that it is attempting to reconstruct a specific stored key or request a specific group authorization key), etc.

[0094] In some embodiments, the encrypted slices discussed throughout this disclosure can be encoded into error-correcting codes (such as erasure codes) to create a second set of slices. The codes used can be any type of error-correcting code (e.g., 3+P, cyclone codes, Reed-Solomon codes, etc.), including codes with multiple parity checks.

[0095] In some embodiments, even in the "encrypt then slice" method, a fingerprint can be generated for each encrypted slice and sent to a group authorization authority. This allows the group authorization authority to detect whether a key unit contains altered slices (which could be evidence of a malicious attacker or corruption). Error-correcting codes can also detect and correct such alterations (up to the power of the code).

[0096] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0097] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing power, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management costs or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0098] The features are as follows:

[0099] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power (such as server time and network storage) on demand without human interaction with the service provider.

[0100] Wide network access: Capabilities are available on the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0101] Resource pooling: A provider's computing resources are grouped into resource pools to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Typically, consumers cannot control or know the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center), thus exhibiting location independence.

[0102] Rapid flexibility: Capabilities can be rapidly and flexibly (in some cases automatically) provided to expand outward quickly and be rapidly released to shrink back down. For consumers, the available capacity often appears unlimited and can be purchased at any time and in any quantity.

[0103] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0104] The service model is as follows:

[0105] Software as a Service (SaaS): The capability offered to consumers is the ability to use applications running on a provider's cloud infrastructure. These applications can be accessed from various client devices via thin client interfaces such as web browsers (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities.

[0106] Platform as a Service (PaaS): This provides consumers with the ability to deploy consumer-created or acquired applications on cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0107] Infrastructure as a Service (IaaS): This provides consumers with the capability to deploy and run any software, including operating systems and applications, on the cloud, providing them with processing, storage, networking, and other basic computing resources. Consumers neither manage nor control the underlying cloud infrastructure, but they have control over the operating system, storage, and deployed applications, and may have limited control over chosen network components (e.g., host firewalls).

[0108] The deployment model is as follows:

[0109] Private cloud: A cloud infrastructure that operates exclusively for a single organization. It can be managed by that organization or a third party, and can exist inside or outside the organization.

[0110] Community cloud: Cloud infrastructure shared by several organizations and supporting a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist inside or outside the organization.

[0111] Public cloud: Cloud infrastructure available to the general public or large industrial groups and owned by organizations that sell cloud services.

[0112] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursts for load balancing between clouds).

[0113] Cloud computing environments are service-oriented, characterized by statelessness, loose coupling, modularity, and semantic interoperability. The core of computing is the infrastructure comprising a network of interconnected nodes.

[0114] Now for reference Figure 8The diagram illustrates an illustrative cloud computing environment 800. As shown, the cloud computing environment 800 includes one or more cloud computing nodes 810 with which local computing devices used by cloud consumers can communicate. Examples of these local computing devices include, but are not limited to, a personal digital assistant (PDA) or cellular phone 840A, a desktop computer 840B, a laptop computer 840C, and / or an automotive computer system 840N. Nodes 810 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 800 to provide Infrastructure as a Service, Platform as a Service, and / or Software as a Service without requiring cloud consumers to maintain resources on their local computing devices. It should be understood that... Figure 8 The types of computing devices 840A-N shown are merely illustrative, and the computing node 810 and cloud computing environment 800 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0115] Now for reference Figure 9 This demonstrates the 800 (cloud computing environment) Figure 8 This provides a set of functional abstractions. It should be understood beforehand that... Figure 9 The components, layers, and functions shown are merely illustrative, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0116] The hardware and software layer 960 includes hardware and software components. Examples of hardware components include: a mainframe 961; a RISC (Reduced Instruction Set Computer) based server 962; a server 963; a blade server 964; a storage device 965; and network and networking components 966. In some embodiments, software components include network application server software 967 and database software 968.

[0117] The virtualization layer 970 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 971; virtual storage 972; virtual networks 973, including virtual private networks; virtual applications and operating systems 974; and virtual clients 975.

[0118] In one example, management layer 980 can provide the following functionalities: Resource Provisioning 981: Provides dynamic acquisition of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 982: Provides cost tracking for the use of resources in the cloud computing environment and provides invoices or bills for the consumption of these resources. In one example, these resources may include application software licenses. Security Functions: Provides authentication for cloud consumers and tasks and protection for data and other resources. User Portal 983: Provides access to the cloud computing environment for consumers and system administrators. Service Level Management 984: Provides cloud resource allocation and management to meet required service levels. Service Level Agreement (SLA) Planning and Fulfillment 985: Provides pre-scheduling and procurement of cloud resources according to the SLA for its projected future needs.

[0119] Workload tier 990 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities available in this tier include, but are not limited to: mapping and navigation 991; software development and lifecycle management 992; virtual classroom instruction provision 993; data analysis and processing 994; transaction processing 995; and secure secret recovery 996.

[0120] Now for reference Figure 10 This document illustrates a high-level block diagram of an example computer system 1000 that can be configured to perform various aspects of this disclosure, including, for example, methods 200, 300, 400, 500, and / or 700. According to embodiments of this disclosure, the example computer system 1000 can be used to implement one or more of the methods or modules described herein, as well as any associated functions or operations (e.g., using one or more processor circuits or a computer processor). In some embodiments, the main components of the computer system 1000 may include one or more CPUs 1002, a memory subsystem 1008, a terminal interface 1016, a storage interface 1018, an I / O (input / output) device interface 1020, and a network interface 1022, all of which may be directly or indirectly communicatively coupled to enable inter-component communication via a memory bus 1006, an I / O bus 1014, and an I / O bus interface unit 1012.

[0121] Computer system 1000 may include one or more general-purpose programmable central processing units (CPUs) 1002, some or all of which may include one or more cores 1004A, 1004B, 1004C, and 1004D, collectively referred to herein as CPU 1002. In some embodiments, computer system 1000 may include a typical multiple processors of a relatively large system; however, in other embodiments, computer system 1000 may alternatively be a single-CPU system. Each CPU 1002 may execute instructions stored in memory subsystem 1008 on CPU core 1004 and may include one or more levels of onboard cache.

[0122] In some embodiments, memory subsystem 1008 may include random access semiconductor memory, storage devices, or storage media (volatile or non-volatile) for storing data and programs. In some embodiments, memory subsystem 1008 may represent the entire virtual memory of computer system 1000 and may also include virtual memory of other computer systems coupled to or connected via a network to computer system 1000. Memory subsystem 1008 may conceptually be a single monolithic entity, but in some embodiments, memory subsystem 1008 may be a more complex arrangement, such as a hierarchy of caches and other memory devices. For example, memory may reside in multi-level caches, and these caches may be further functionally partitioned such that one cache holds instructions while another cache holds non-instruction data used by one or more processors. Memory may also be distributed and associated with different CPUs or sets of CPUs, as is known in any of the various so-called Non-Uniform Memory Access (NUMA) computer architectures. In some embodiments, main memory or memory subsystem 804 may include elements for the control and flow of memory used by CPU 1002. This may include memory controller 1010.

[0123] Although the memory bus 1006 is in Figure 10The system is shown as a single-bus architecture providing a direct communication path between CPU 1002, memory subsystem 1008, and I / O bus interface 1012. However, in some embodiments, memory bus 1006 may include multiple different buses or communication paths, which may be arranged in any of a variety of forms, such as point-to-point links in hierarchical, star, or mesh configurations, multi-level buses, parallel and redundant paths, or any other suitable type of configuration. Furthermore, while I / O bus interface 1012 and I / O bus 1014 are shown as a single corresponding unit, in some embodiments, computer system 1000 may include multiple I / O bus interface units 1012, multiple I / O buses 1014, or both. Additionally, while multiple I / O interface units separating I / O bus 1014 from various communication paths to various I / O devices are shown, in other embodiments, some or all I / O devices may be directly connected to one or more system I / O buses.

[0124] In some embodiments, computer system 1000 may be a multi-user mainframe computer system, a single-user system, a server computer, or a similar device that has little or no direct user interface but receives requests from other computer systems (clients). Further, in some embodiments, computer system 1000 may be implemented as a desktop computer, portable computer, laptop or notebook computer, tablet computer, pocket computer, telephone, smartphone, mobile device, or any other suitable type of electronic device.

[0125] Notice, Figure 10 The purpose is to depict representative main components of the example computer system 1000. However, in some embodiments, the individual components may have more... Figure 10 The greater or lesser complexity represented therein can exist differently from... Figure 10 The components shown or other components may vary in number, type, and configuration.

[0126] This invention can be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0127] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or recessed structures with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0128] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device, or downloaded via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network) to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0129] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including local area network (LAN) or wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to perform aspects of this invention, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to personalize the electronic circuits by utilizing the status information of the computer-readable program instructions.

[0130] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0131] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium in which the instructions are stored includes an article of writing comprising instructions for implementing aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0132] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus or other device, perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0133] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a different order than indicated in the figures. For example, two blocks shown consecutively may actually be implemented as a single step, executed simultaneously, substantially simultaneously, with partial or complete time overlap, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0134] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements to technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for reconstructing a secret from a first key unit, the method comprising: Receive the first encrypted slice from the second key unit and the second encrypted slice from the third key unit; Send the fingerprints of the first encrypted slice and the second encrypted slice to the group authorization authority; In response to the group authorization authority's verification of the fingerprint, receive multiple group permission keys from the group authorization authority; The first encrypted slice and the second encrypted slice are decrypted using the plurality of group permission keys, wherein the first encrypted slice and the second encrypted slice are decrypted using different group permission keys; The secret is reconstructed based on the first decrypted slice and the second decrypted slice; The reconstructed secret is divided into a first new slice and a second new slice; The first new slice and the second new slice are encrypted using a new group permission key from the group authorization authority, wherein the first new slice and the second new slice are encrypted using different new group permission keys; and The first encrypted slice and the second encrypted slice are sent to the second key unit and the third key unit, respectively, to replace the first encrypted slice and the second encrypted slice.

2. The method according to claim 1, further comprising: Generate a first fingerprint for the first encrypted slice and a second fingerprint for the second encrypted slice; wherein receiving the plurality of group authorization keys is in response to the group authorization authority verifying the first fingerprint and the second fingerprint.

3. The method according to claim 1, further comprising: Generate the first new fingerprint of the first encrypted new slice; Generate a second new fingerprint for a second encrypted new slice; as well as The first new fingerprint and the second new fingerprint are sent to the group authorization agency.

4. The method according to claim 1, further comprising: Receive the third encrypted slice from the second key unit; Receive the fourth encrypted slice from the third key unit; as well as The third encrypted slice and the fourth encrypted slice are stored in the slice storage device.

5. The method according to claim 4, further comprising: It has been determined that the third key unit has malfunctioned; Receive a request from the group authorization authority to transmit the fourth encrypted slice to the fourth key unit; as well as The fourth encrypted slice is transmitted to the fourth key unit.

6. The method according to claim 1, further comprising: Encrypt the secrets of the reconstruction; The reconstructed secret is stored in the secret access control unit; Receive a request from the user, the request including a user key; Use the user key to decrypt the secret of the reconstruction; as well as The request is responded to using the secret of the reconstruction.

7. The method according to any one of claims 1-6, wherein, The secret is the storage of the encryption key.

8. The method according to any one of claims 1-6, wherein, The group's authorizing body is a certificate authority.

9. A computer system, comprising: Memory; as well as A central processing unit (CPU) coupled to the memory, the CPU being configured to execute instructions to replace the key unit in order to: Receive a first encrypted slice from the second key unit of a set of key units, and receive a second encrypted slice from the third key unit of the same set of key units; Send the fingerprints of the first encrypted slice and the second encrypted slice to the group authorization authority; In response to the group authorization authority's verification of the fingerprint, receive multiple group permission keys from the group authorization authority; The first encrypted slice and the second encrypted slice are decrypted using the plurality of group permission keys, wherein the first encrypted slice and the second encrypted slice are decrypted using different group permission keys; The secret is reconstructed based on the first decrypted slice and the second decrypted slice; The reconstructed secret is divided into a first new slice and a second new slice; The first new slice and the second new slice are encrypted using a new group permission key from the group authorization authority, wherein the first new slice and the second new slice are encrypted using different new group permission keys; and The first encrypted slice and the second encrypted slice are sent to the second key unit and the third key unit, respectively, to replace the first encrypted slice and the second encrypted slice.

10. The system according to claim 9, wherein, The replacement key unit is added to the group of key units, and the identity of the replacement key unit is verified.

11. The system according to claim 9, wherein, The CPU is also configured to: Receive multiple new group permission keys generated by the group authorization authority.

12. The system according to claim 11, wherein, The CPU is also configured to: Generate the first new fingerprint of the first encrypted new slice; Generate a second new fingerprint for a second new encrypted slice; and The first new fingerprint and the second new fingerprint are sent to the group authorization agency.

13. The system according to any one of claims 9 to 12, wherein, The group's authorizing body is a certificate authority.

14. The system according to any one of claims 9 to 12, wherein, The secret is the storage of the encryption key.

15. A computer program product comprising program instructions executable by a computer that replaces a key unit to cause the computer to: Receive the first encrypted slice from the second key unit and the second encrypted slice from the third key unit; Send the fingerprints of the first encrypted slice and the second encrypted slice to the group authorization authority; In response to the group authorization authority's verification of the fingerprint, receive one or more group authorization keys from the group authorization authority; as well as The first encrypted slice and the second encrypted slice are decrypted using the plurality of group permission keys, wherein the first encrypted slice and the second encrypted slice are decrypted using different group permission keys; The secret is reconstructed based on the first decrypted slice and the second decrypted slice; The reconstructed secret is divided into a first new slice and a second new slice; The first new slice and the second new slice are encrypted using a new group permission key from the group authorization authority, wherein the first new slice and the second new slice are encrypted using different new group permission keys; and The first encrypted slice and the second encrypted slice are sent to the second key unit and the third key unit, respectively, to replace the first encrypted slice and the second encrypted slice.

16. The computer program product according to claim 15, wherein, The instructions further enable the computer to: Generate a first fingerprint for the first encrypted slice and a second fingerprint for the second encrypted slice.

17. The computer program product according to claim 15, wherein, The instructions further enable the computer to: The first fingerprint of the first encrypted slice and the second fingerprint of the second encrypted slice are transmitted to the group authorization authority.

18. The computer program product according to claim 15, wherein, The instructions further enable the computer to: The secret is divided into multiple new slices; and The multiple group permission keys are used to encrypt the multiple new slices.

19. The computer program product according to claim 18, wherein, The instructions further instruct the computer to transmit multiple encrypted new slices to multiple key units.

20. The computer program product according to claim 19, wherein, The instructions further enable the computer to: Based on the aforementioned multiple encrypted new slices and error correction codes, a second set of multiple slices is generated; and The second plurality of slices are transmitted to the plurality of key units.

21. The computer program product according to claim 15, wherein, The instructions further enable the computer to: Receive a first encrypted slice from a first key unit and a second encrypted slice from a second key unit; Store the first encrypted slice and the second encrypted slice; Receive a request from the group authorization authority to transmit the second encrypted slice to the replacement key unit; as well as In response to the request, the second encrypted slice is transmitted to the replacement key unit.

22. The computer program product according to claim 21, wherein, The instructions further enable the computer to: Receive a replacement slice from the replacement key unit; and Replace the first encrypted slice with the replacement slice.

23. The computer program product according to claim 22, wherein, The instructions further enable the computer to: Receive one or more new group permission keys from the group authorization authority; Based on the one or more group permission keys, generate one or more new encrypted slices of the secret; as well as At least one of the one or more encrypted new slices is transmitted to the replacement key unit.

Images