Automated System Security via Secret Sharing and Gatekeeper
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In automated systems, sensitive information such as HSM PINs or passwords are often left unprotected in clear-text configurations, posing a security risk as humans are not involved in operations, leading to potential leakage.
Innovation Solution
An automated system with a configuration subsystem and a production subsystem, utilizing a secret sharing scheme to securely distribute and reconstruct a secret value among components, where a gatekeeper retrieves a subset of secret shares only when access is needed and deletes the secret value immediately, ensuring secure access to an entity like a Hardware Security Module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If secret values are stored in clear-text configuration files for automated system operation, then system automation is enabled, but security is compromised due to potential leakage
Solution Approach 1:
The secret value is segmented into multiple secret shares using a secret sharing scheme. Each component receives only a portion (secret share) of the original secret, making it impossible to reconstruct the secret value unless a threshold number of shares are combined. This segmentation enables automated system operation while preventing security compromises from clear-text storage.
2Object-affected harmful factors
If secret shares are distributed to multiple components, then security is improved through distribution, but system complexity increases
Solution Approach 1:
A gatekeeper component is introduced as an intermediary that manages the collection and reconstruction of secret shares. The gatekeeper receives secret shares from multiple components, reconstructs the original secret value when needed, and handles the complexity of coordinate transformation and share management. This intermediary approach improves security through distribution while containing system complexity in a dedicated management component.
3Ease of operation
If the gatekeeper stores the first secret value for access operations, then access control is enabled, but the risk of secret value exposure increases
Solution Approach 1:
The gatekeeper pre-computes a second secret value from the distributed secret shares and stores it in encrypted form or in a secure manner before actual access operations. When access is needed, the gatekeeper uses this pre-prepared second secret value rather than storing the original first secret value in plaintext. This preliminary action enables access control while reducing the risk of secret value exposure during normal operations.
Data Source
Figure 1
Figure 2
AI summary
A method for securing a system including a configuration subsystem and a production subsystem. The configuration subsystem is separate from the production subsystem that comprises a plurality of components, a gatekeeper and an entity secured with a first secret value. A generator hosted in the configuration subsystem selects a secret sharing scheme and generates, from an input parameter different from the first secret value, a set of secret shares using the secret sharing scheme. The generator uniquely assigns and securely sends a secret share extracted from the set to each of the components. The gatekeeper gets a subset of the secret shares from the components and constructs a second secret value from the subset using the secret sharing scheme. The gatekeeper computes the first secret value by applying a preset function to the second secret value, and then the gatekeeper unlocks access to the entity using the first secret value.