Cryptographic Offloading with Multi-Factor Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection mechanisms are inadequate in securing sensitive data on unsecured hosts, as they fail to protect against remote network attacks and are often disruptive to user workflows, with local credential input compromising cryptographic keys and operations.
Innovation Solution
A system integrating multi-factor authentication with cryptographic offloading, using a client-server architecture that securely manages encryption and decryption, offloads cryptographic operations, and provides protected access to plaintext content, ensuring continuous protection and seamless user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full disk encryption is used, then data is protected at rest, but credentials are provided during system boot unlocking the system to attackers
Solution Approach 1:
The patent extracts the decryption key from the local system by using a remote trusted platform to hold and provide decryption credentials only when needed. The decryption key is not stored locally and cannot be accessed by attackers who compromise the local system, effectively removing the vulnerability point that full disk encryption has during system boot.
Solution Approach 2:
The patent introduces a remote trusted platform as an intermediary between the encrypted data and the decryption credentials. This intermediary verifies system integrity remotely and only provides decryption credentials when the system is in a trusted state, preventing attackers from obtaining credentials even if they compromise the local system.
2Reliability
If file encryption is used, then data is protected, but key logging malware captures credentials and decryption keys
Solution Approach 1:
The patent extracts the decryption key from local storage and moves it to a remote trusted platform. The key never resides in plaintext on the local system, making it impossible for key logging malware to capture. The system uses remote attestation to verify integrity before the remote platform temporarily provides decryption credentials for authorized operations.
Solution Approach 2:
The system performs self-verification through remote attestation, where the local system proves its integrity to the remote trusted platform without human intervention. The remote platform automatically verifies system state and only provides decryption credentials when integrity is confirmed, eliminating the need for users to manually manage keys that could be stolen by malware.
3Ease of operation
If encrypted data is decrypted for use, then data becomes accessible, but plaintext content is exposed to attackers
Solution Approach 1:
The patent maintains continuous encryption protection by keeping data encrypted at all times except during brief, controlled decryption operations. The remote trusted platform continuously verifies system integrity and only allows decryption when needed for authorized operations, ensuring protection is maintained before, during, and after data access.
Solution Approach 2:
The remote trusted platform acts as an intermediary that controls all decryption operations. It verifies system integrity and authorizes decryption only for specific authorized operations, then immediately re-encrypts data afterward. This intermediary ensures plaintext is never exposed to attackers even during legitimate data access operations.
4Reliability
If token-based authentication is used, then insulation from local attacks is provided, but active tokens connected for extended periods diminish their value
Solution Approach 1:
The patent implements periodic verification of system integrity through remote attestation before providing decryption credentials. Instead of maintaining continuous token connections, the system periodically proves its integrity to the remote trusted platform, which then temporarily provides credentials for the next authorized operation. This periodic verification maintains security while enabling continuous legitimate access.
5Productivity
If cryptographic operations are performed locally, then processing is fast, but visibility to keying material provides compromise opportunities
Solution Approach 1:
The patent extracts the decryption key from local processing and moves it to a remote trusted platform. Cryptographic operations that require the key are performed remotely or with the key never present locally. This maintains security by eliminating local visibility to keying material while still enabling cryptographic operations through remote processing or keyless encryption schemes.
Data Source
AI summary
The advanced data protection system is implemented by distributing data encryption across multiple isolated computing systems and using multi-factor authentication to access remote, protected decryption material. Architectural components include: Client application software reading/writing from/to a client data store executing on a client host computer, client application plug-ins communicating with external authentication devices, server application software reading/write data from/to a server data store executing on a host computer which is physically or virtually isolated from the client host computer, authentication devices, components, or systems integrated with or connected to the client computer and exposing programmatic interfaces to client application software, and secure networking components executing on both hosts that provide secure data exchange. The system employs certain associated software that incrementally encrypts client data on both the client and server, storing portions of the results on each computer, and requiring multi-factor authentication for distributed decryption material recovery.