Cryptographic Key Audit Partitioning for Law Enforcement Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key escrow systems do not provide real-time notification to devices about exposure of messages, failing to balance public and personal security needs, particularly in scenarios where law enforcement access is required.
Innovation Solution
A computing device architecture with multiple partitions, including a Malware Protected Partition and an Access Protected Partition, where the latter allows authorized external access while ensuring secure data protection and real-time auditing of cryptographic key usage, ensuring that law enforcement access is recorded and users are informed of potential exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a key escrow system allows external access to cryptographic keys for law enforcement purposes, then public security needs are met, but the device cannot detect or notify users of message exposure
Solution Approach 1:
The system divides the cryptographic key management into separate partitions: a secure partition where keys are stored and used, and an audit partition where usage is recorded. This segmentation allows law enforcement access to keys while maintaining separate audit trails that can notify users of exposure without compromising key security.
Solution Approach 2:
The patent implements an audit mechanism that provides feedback to users about key usage. When a cryptographic key is used to decrypt messages, the audit system records this usage and can notify the user, creating a feedback loop that informs users of potential exposure while maintaining the key escrow functionality.
2Reliability
If cryptographic keys are protected from all external access, then personal security is maintained, but law enforcement cannot access messages when required
Solution Approach 1:
The system creates multiple security partitions with different access policies. One partition maintains strong protection for personal security, while another partition provides controlled access for law enforcement. This segmentation resolves the contradiction by allowing both strong protection and authorized access through different pathways.
Solution Approach 2:
Different security levels are applied to different parts of the system. The key storage and execution environment maintains high security for personal protection, while the audit and notification subsystem provides adaptability for law enforcement access. Each partition has security properties optimized for its specific function.
3Loss of information
If audit records of key usage are maintained, then user notification of exposure is enabled, but the system complexity increases
Solution Approach 1:
The audit functionality is merged with the existing key management infrastructure rather than being implemented as a completely separate system. The audit records are integrated into the key usage workflow, allowing exposure notification capability to be added without proportionally increasing overall system complexity.
Data Source
AI summary
Methods and apparati for auditing uses of audited cryptographic keys. In a method embodiment of the present invention, a set of audited uses for an audited cryptographic key is defined; the key is used inside a protected execution environment of a digital computer; a digitally signed audit record describing an instance of use of the audited cryptographic key is released for each audited use of the audited cryptographic key; a signed receipt of digitally signed audit records is received from an auditor; a digital signature of the signed receipt of the auditor is verified inside the protected execution environment using a public verification key of the auditor; the set of audit records that have not been verified by the auditor is determined; a set of allowable conditions for the set of non-verified audit records is stored; and the protected execution environment is prevented from outputting the results of an instance of an audited use of the audited cryptographic key when the set of non-verified audit records does not meet all of the conditions in the set of allowable conditions.