Cloud Credential Fragmentation via Key Sharding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for smart devices in smart buildings fail to adequately protect cloud-service credentials from breaches caused by physical removal or theft of devices, leading to potential compromises of user credentials.
Innovation Solution
A computer-implemented method and system that securely shares cloud-service credentials by encrypting and dividing a decryption key into fragments, distributing these fragments among networked devices, allowing reconstruction with a minimum number of fragments defined by a security policy, thereby preventing breaches even if a device is removed or compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are stored on individual networked devices, then devices can access cloud services independently, but security is compromised when devices are removed, stolen, or malfunction
Solution Approach 1:
The decryption key is divided into multiple fragments and distributed across different networked devices. Each device stores only a portion of the key, making it impossible to reconstruct the full key without a minimum number of fragments. This segmentation ensures that even if individual devices are compromised, the complete credential remains secure.
Solution Approach 2:
The central computing device acts as an intermediary that coordinates key fragment distribution and reconstruction. It manages the security policy, determines which devices hold which fragments, and facilitates the reconstruction process when needed, while never storing the complete decryption key itself.
2Reliability
If decryption key fragments are distributed to multiple devices, then security is improved against device theft, but system complexity increases
Solution Approach 1:
The system automatically manages key fragment distribution and reconstruction without requiring manual intervention. The central computing device autonomously determines which fragments to distribute to which devices based on the security policy, and automatically coordinates fragment collection and reconstruction when access is needed, reducing operational complexity.
Solution Approach 2:
The key fragment distribution mechanism serves multiple functions: it provides security against device theft, enables automatic credential recovery when devices are replaced, and allows flexible security policy enforcement. The same infrastructure supports both security protection and seamless device replacement.
3Reliability
If a minimum number of fragments is required for decryption, then security policy control is enhanced, but access operations become more complex
Solution Approach 1:
The central computing device monitors which devices are available and holds which key fragments, using this feedback information to determine whether the minimum number of fragments can be reconstructed. It dynamically adjusts the reconstruction process based on real-time device availability and fragment distribution status.
Solution Approach 2:
The system pre-distributes key fragments to devices during setup, and pre-establishes the security policy defining the minimum number of fragments required. When access is needed, the system checks whether sufficient fragments are available before attempting reconstruction, avoiding unnecessary operational complexity.
Data Source
AI summary
A computer-implemented method for securely sharing cloud-service credentials within a network of computing devices may include (i) identifying, by a central computing device, a set of networked devices, (ii) encrypting, by the central computing device, at least one user credential for a cloud service, (iii) dividing, by the central computing device, a decryption key for decrypting the user credential into a set of fragments such that a minimum number of fragments, as defined by a security policy, is required to decrypt the user credential, and (iv) securing the user credential by distributing the set of fragments of the decryption key from the central computing device to the set of networked devices in compliance with the security policy. Various other methods, systems, and computer-readable media are also disclosed.