Centralized Secret Key Management via Identifier Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secret sharing schemes require secure transmission of derived values between a central authority and entities, which can be vulnerable to unauthorized access, and do not efficiently manage changes in the number of entities or secret keys.
Innovation Solution
A system where each entity provides a unique identifier to a central authority, which generates and stores derived values, allowing reconstruction of the secret only with a quorum of identifiers, without transmitting sensitive information to entities, enabling secure and flexible management of secret sharing and key changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If derived values are distributed to participating entities in traditional secret sharing schemes, then entities can independently reconstruct the secret with a quorum, but secure transmission channels are required and vulnerability to unauthorized access increases
Solution Approach 1:
The patent extracts the derived values from the distribution process entirely. Instead of giving derived values to entities, the system keeps them centralized at the central authority. Entities only hold their identifiers, which are meaningless without the centralized derived values. This extraction eliminates the need for secure transmission channels while maintaining secret reconstruction capability.
Solution Approach 2:
The central authority acts as an intermediary that holds the derived values and performs the reconstruction operation. When secret reconstruction is needed, the central authority receives quorum identifiers from entities, computes the derived values locally, and reconstructs the secret without entities ever receiving sensitive derived values. This intermediary approach maintains reliability while eliminating security vulnerabilities of direct distribution.
2Ease of operation
If traditional secret sharing schemes are used with distributed derived values, then entities have autonomy in secret reconstruction, but system complexity increases due to key management and secure channel requirements
Solution Approach 1:
The patent removes the complex key management infrastructure from the system by extracting all derived value storage and management operations to the central authority. Entities simply store their identifiers and submit them to the central authority for reconstruction, eliminating the need for entities to manage secure storage of derived values or maintain secure transmission channels.
Solution Approach 2:
The central authority provides a self-service reconstruction mechanism where entities simply submit their identifiers and the central authority automatically performs the reconstruction operation using its stored derived values. This eliminates the need for complex coordination between entities and simplifies the operational process while reducing system complexity.
3Reliability
If secret shares are distributed to N entities requiring K for reconstruction, then security is improved through distribution, but the system cannot efficiently handle changes in entity count or secret key updates
Solution Approach 1:
The patent implements a dynamic system where the central authority can efficiently add or remove entities by simply updating its stored derived values corresponding to entity identifiers. When entities are added or removed, the central authority computes new derived values using the secret and the polynomial evaluation function, updating its storage without requiring redistribution to all entities. This maintains security while providing adaptability to organizational changes.
Solution Approach 2:
The central authority pre-computes and stores derived values for all possible entity identifiers using the secret and the polynomial function. This preliminary action enables rapid addition or removal of entities without requiring complex redistribution operations, as the central authority already has the computational framework ready to generate or remove derived values as needed.
Data Source
AI summary
The presently disclosed subject matter includes a computerized method and system of implementing a secret management scheme. According to the proposed approach, values derived from a secret are not distributed to the participating entities. Instead, each participating entity provides a respective preexisting identifier that is not derived from the secret.