Credentialed Encryption via Segmented Key Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face challenges in securely managing secret keys to prevent malicious applications from damaging systems, intercepting messages, and stealing data, with compromised keys potentially being usable across multiple systems.
Innovation Solution
Implementing a secure local service that performs encryption and decryption using unique secret keys, restricting access through credentials and secure channels, and employing a method to limit data access even if keys are compromised by dividing encrypted data into segments for recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret keys are used to encrypt data across multiple systems, then encryption security is improved, but the risk of key compromise across multiple systems increases
Solution Approach 1:
The patent segments the secret key into multiple key segments and distributes them across different systems. No single system possesses the complete key, so compromise of one system does not expose the entire key. The key is reconstructed only when all segments are combined through secure multi-party computation.
Solution Approach 2:
The patent introduces a secure multi-party computation protocol as an intermediary mechanism that enables joint encryption without any single party having access to the complete secret key. This intermediary layer ensures that even if individual systems are compromised, the attacker cannot obtain the full key or decrypt data independently.
2Ease of operation
If a centralized key management system is used, then key distribution is simplified, but the system becomes a single point of failure
Solution Approach 1:
The centralized key management function is segmented across multiple distributed systems. Each system holds only a portion of the key material, eliminating the single point of failure that would exist in a centralized key repository. The system remains operational even if individual nodes fail or are compromised.
Solution Approach 2:
The distributed key management system provides universal functionality across multiple systems without requiring a centralized authority. Each participant can independently contribute to key operations while maintaining the same encryption and decryption capabilities that would exist in a centralized system.
3Speed
If complete secret keys are stored locally on each system, then encryption speed is improved, but security exposure increases
Solution Approach 1:
Instead of storing complete secret keys locally, the system stores only key segments locally. This maintains fast local encryption operations for the portions of data that can be processed with available segments, while reducing security exposure since no single location contains the complete key.
Solution Approach 2:
The system performs preliminary key segmentation and distribution before encryption operations begin. Key segments are pre-distributed to various systems in a secure manner, enabling fast local encryption while ensuring that complete key material never resides in a single location.
Data Source
AI summary
Examples associated with credentialed encryption are described. One example method includes receiving an encryption request from a local process via a secure channel. The encryption request includes a credential associated with the local process. Whether the local process is authorized to access an encryption function is verified using the credential. The encryption function specified in the encryption request is performed using a security key unique to a system performing the method. A result of the encryption function is provided to the local process.