Cryptography Key Splitting for Single Point of Attack Elimination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptography key storage systems are vulnerable to single points of attack, compromising the security of data stored in key repositories, which can lead to unauthorized access and data breaches.
Innovation Solution
A method where a cryptography key is split into two parts, with one part stored in policy-controlled storage and the other in local storage, allowing secure access and reconstruction of the key without a single point of vulnerability, using Shamir's Secret Sharing technique for additional security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single centralized key repository is used to store cryptography keys, then key access and management is simplified, but security is compromised due to single points of attack
Solution Approach 1:
The patent divides the cryptography key into multiple separate key parts (first key part and second key part) and stores them in different locations (policy-controlled storage and local storage). This segmentation eliminates the single point of attack while maintaining the ability to reconstruct the full key when needed, thus resolving the contradiction between simplified access and security.
2Reliability
If key parts are distributed across multiple storage locations, then security is improved by eliminating single points of attack, but system complexity increases
Solution Approach 1:
The key is segmented into multiple parts stored in different locations, which improves security. The complexity is managed through clear separation of responsibilities: policy-controlled storage handles secure storage of the first key part with access policies, while local storage handles the second key part. This segmentation approach resolves the contradiction by distributing security functions across independent components.
Solution Approach 2:
The patent introduces a policy-controlled storage system as an intermediary that manages access to the first key part through defined policies. This intermediary layer simplifies the overall system by providing centralized access control without requiring complex authentication mechanisms at every access point, thus managing complexity while maintaining security.
3Reliability
If policy-controlled storage is used to store key parts with access policies, then unauthorized access is prevented, but access control complexity increases
Solution Approach 1:
The policy-controlled storage acts as an intermediary that centralizes access control for the first key part. By implementing access policies at this intermediate layer, the system prevents unauthorized access without requiring complex authentication at every access point. The policy-controlled storage handles the complexity of access control centrally, resolving the contradiction between security and complexity.
Data Source
AI summary
According to an aspect, a first digital system splits a cryptography key into a first key part (S1) and a second key part (S2), stores S1 in a policy-controlled storage which permits storage according to access policies and stores S2 in a local storage of the first digital system. Upon identifying a requirement in a second digital system for the cryptography key, the first digital system configures for the policy-controlled storage a first policy permitting access of S1 to the second digital system and then sends S2 directly to the second digital system. The second digital system reconstructs the cryptography key by retrieving S1 from the policy-controlled storage based on the first policy and forming the cryptography key from the retrieved S1 and S2 received from the first digital system. Thus, a cryptography key is securely stored and used, without having any single point of attack.