Cloud Secret Key Protection via Multi-Party Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face security risks due to the storage of secret keys in nodes, which can be compromised during cyber-attacks, leading to potential system compromise if keys are stored in memory or on disk.
Innovation Solution
A proxy platform uses a multi-party computation algorithm to generate secret keys by determining a set of nodes associated with the key from a proxy platform data store, distributing partial key portions across multiple nodes, and computing the key within a secure enclave, ensuring that no single node stores the complete secret.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secret key is stored at a single node in memory or on disk, then the key is easily accessible and the system operates efficiently, but the node becomes vulnerable to compromise during cyber-attacks
Solution Approach 1:
The patent divides the secret key into multiple discrete shares and distributes them across different nodes in the cloud computing environment. Each node stores only a portion of the key, not the complete key. This segmentation ensures that no single node compromise reveals the entire key, while still allowing the system to function by reconstructing the key from the distributed shares when needed.
2Reliability
If secret keys are distributed across multiple nodes using multi-party computation, then security is improved, but the complexity of key management and access increases
Solution Approach 1:
The patent introduces a key management service as an intermediary component that handles the complexity of multi-party computation and key reconstruction. This service mediates between nodes that need to access the key and the distributed key shares, automatically managing the complex operations of key reconstruction without requiring manual intervention or complex user-side implementation.
Solution Approach 2:
The system enables nodes to automatically retrieve and reconstruct secret keys without requiring manual intervention. When a node needs to access a secret key, it can autonomously request the necessary key shares from other nodes and participate in the automatic key reconstruction process, reducing operational complexity while maintaining security.
3Speed
If complete secret keys are stored at each node, then key access is fast and straightforward, but any compromised node can expose the entire key
Solution Approach 1:
The patent segments the secret key into multiple shares distributed across different nodes. Each node stores only a fragment of the key, so even if a node is compromised, the attacker cannot obtain the complete key. The key can still be accessed quickly by reconstructing it from the distributed shares when authorized.
Solution Approach 2:
The system prepares and distributes key shares in advance across multiple nodes before any compromise occurs. This pre-distribution ensures that if a node is compromised later, the complete key is already protected by the fact that other nodes hold additional shares that cannot be compromised independently.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems may be associated with a cloud computing environment. A proxy platform data store may contain node data associated with nodes of the cloud computing environment. Each node might, for example, store multi-party computation information. A proxy platform, able to access the proxy platform data store, may detect that a first node needs to access a cloud application secret key and determine, based on information in the proxy platform data store, a set of nodes associated with the secret key that the first node needs to access. The proxy platform may then use a multi-party computation algorithm and information received from the set of nodes to generate the secret key.