Modified AES Key Expansion for Customer Due Diligence Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The vulnerability of using a single initial key in the Advanced Encryption Standard (AES) poses a security risk, as it can be compromised by bad actors, potentially exposing encrypted data.
Innovation Solution
Implementing a modified key expansion schedule that requires multiple different cipher keys, with one key stored by the service provider and another at the customer's client device, enhancing security by ensuring that the service provider cannot decrypt encrypted information without customer login.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single initial key is used in AES encryption, then the encryption process is simple and efficient, but the security is vulnerable to compromise
Solution Approach 1:
The single initial key is segmented into multiple component keys (first key, second key, third key) that are combined through the key expansion schedule to generate round keys. This segmentation distributes the security burden across multiple keys stored in different locations, improving reliability while maintaining a structured encryption process.
Solution Approach 2:
The encryption system employs nested key structures where component keys are nested within the key expansion process. The first key, second key, and third key are nested in sequence through the key expansion schedule, with each key contributing to the derivation of subsequent round keys, creating a layered security architecture.
2Reliability
If multiple different cipher keys are required, then security is enhanced by distributing keys across different locations, but the encryption process becomes more complex
Solution Approach 1:
The encryption system segments the key management process by distributing different component keys across multiple secure locations (service provider system, customer device, and embedded in encrypted data). This segmentation enhances data security by ensuring that no single location holds all keys needed for decryption, while the key expansion schedule provides a systematic method for combining these segmented keys.
3Ease of operation
If the service provider stores all encryption keys, then decryption is convenient for the provider, but security is compromised as the provider can access customer data
Solution Approach 1:
The system extracts critical encryption keys from the service provider's control and places them in customer-controlled locations. Specifically, the second key is stored in the customer's secure element, and the third key is embedded within the encrypted data itself. This extraction ensures that the service provider cannot decrypt data without customer authorization, enhancing security while maintaining decryption convenience through the key expansion process.
Solution Approach 2:
The key expansion schedule acts as an intermediary mechanism that combines multiple component keys (first key from service provider, second key from customer device, third key from encrypted data) to generate the final round keys needed for decryption. This intermediary process ensures that no single party has direct access to all decryption capabilities, balancing security requirements with operational convenience.
Data Source
AI summary
Systems and methods to encrypt centralized information associated with users of a customer due diligence platform based on a modified key expansion schedule are disclosed. Exemplary implementations may: obtain user profile information making up user profiles of users of a customer due diligence platform; encrypt the user profile information to generate encrypted user profile information based on a modified key expansion schedule requiring multiple different keys; effectuate storage of the encrypted user profile information in association with the user profiles in non-transitory electronic storage; and/or perform other operations.