Cloud Encryption Key Broker Splitting Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Recent data breaches have shown that even encrypted data can be exposed when encryption/decryption keys are stolen from secure servers, highlighting the need for a more secure method to manage and protect these keys.
Innovation Solution
A cloud encryption key broker system that splits encryption/decryption keys into parts, storing one part on a remote secure server and requiring independent authorization for access, combined with risk analysis, IP blocking, and access rule restrictions to securely transmit and store key parts, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored on a secure server, then data can be encrypted and protected, but the keys can be stolen allowing data exposure
Solution Approach 1:
The encryption key is divided into multiple parts (first key part, second key part, third key part) and distributed to different user devices. No single device or server possesses the complete key, making it impossible to steal the entire key by compromising one location. The key is only reconstructed temporarily in memory during decryption operations.
Solution Approach 2:
The complete encryption key is extracted from any single storage location or device. Instead of storing the full key on the server or any single device, only fragmented portions are retained elsewhere, while the complete key exists only transiently in memory during operations.
2Object-affected harmful factors
If the complete key is split into parts and distributed, then key theft becomes more difficult, but key management and retrieval becomes more complex
Solution Approach 1:
A key management server acts as an intermediary that coordinates key part distribution, retrieval, and combination. The server receives decryption requests, verifies user authorization, retrieves the necessary key parts from authorized devices, combines them temporarily in memory, performs the decryption operation, and then clears the key from memory. This intermediary manages the complexity of key splitting while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where the key management server communicates with user devices to verify authorization, confirm key part availability, and coordinate the temporary assembly of key parts. The server receives feedback from multiple sources (user authentication, device availability, key part status) and adjusts the key retrieval process accordingly.
3Reliability
If multiple key parts are required for decryption, then security is enhanced, but decryption operation time increases
Solution Approach 1:
Key parts are pre-distributed to authorized user devices before they are needed for decryption. The key management server maintains a registry of which devices hold which key parts, enabling rapid retrieval when decryption is required. This preliminary distribution eliminates the need to generate or transfer key parts at the moment of decryption.
Solution Approach 2:
The system prioritizes and accelerates the key assembly process by directly retrieving pre-stored key parts from authorized devices and combining them immediately in memory for the decryption operation. The process skips unnecessary intermediate steps by having the key management server directly coordinate between the requesting device and the devices holding key parts, minimizing communication overhead and assembly time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Computer-implemented systems and methods are disclosed herein for use in cryptographic operations over a cloud-based service. The cloud-based service securely stores and transmits parts of encryption/decryption keys. Split key processing can include splitting the key in two and storing one of them on a remote secure server.