Decentralized Identifier Private Key Access via Segmented Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized servers storing user private keys face security risks as they disclose user data and are vulnerable to attacks, compromising user privacy and key security.
Innovation Solution
A method utilizing decentralized identifiers and a ledger to securely access private keys without revealing user data, where a first device stores the private and public keys, generates an access token, and verifies an encrypted challenge using the private key, ensuring only authorized access to a first server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized server stores user private keys, then access to private keys is enabled, but user privacy is compromised and security vulnerabilities increase
Solution Approach 1:
The system segments the authentication process into multiple independent components: the first device holds the private key, the second device stores the access token, and the server verifies challenges. This segmentation ensures that no single entity possesses both the private key and authentication capability, thereby protecting user privacy while maintaining security.
Solution Approach 2:
The access token acts as an intermediary that enables the second device to interact with the server without exposing the private key. The token mediates between the key-holding first device and the server, allowing authenticated access while preserving the confidentiality of the private key and user data.
2Ease of operation
If user data is disclosed to the server for authentication, then access control is enabled, but user privacy is compromised
Solution Approach 1:
The system extracts the authentication credential (access token) from the user data itself. Instead of transmitting user data for authentication, the system uses a separate token that proves authentication without revealing any user information. This extraction enables access control while preventing data disclosure.
Solution Approach 2:
The access token is a copy or representation of authentication status that can be transmitted and verified without exposing the original user data. The server verifies the token's validity through cryptographic challenges rather than examining user data, enabling access control while maintaining privacy.
3Device complexity
If private keys are stored centrally, then key management is simplified, but security risks increase due to single point of failure
Solution Approach 1:
The system segments key management functionality across multiple devices. The first device generates and stores the private key, while the second device holds only the access token. This segmentation eliminates the single point of failure inherent in centralized storage, as compromising one device does not expose the private key.
Solution Approach 2:
The system transitions from a single-dimension centralized storage model to a multi-dimensional distributed architecture. The private key exists in one dimension (first device), while authentication occurs in another dimension (second device with token). This dimensional separation reduces security vulnerabilities while maintaining manageable key operations.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This solution protects user privacy by not disclosing private keys or user data, maintaining key security and control over access, while allowing secure access to services without duplicating the private key, thus preventing unauthorized access and data exposure.
Implementation Method 1
decrypting, by the first device, only if the received access token is the generated access token, the encrypted challenge using the private key
Data Source
Figure 1
Figure 2
AI summary
A method (20) for accessing a private key comprises: - storing, by a first device (12), the private key and an associated public key; - generating (22) an access token; - sending (24) to a second device (14), the access token; - sending (28), to a first server (16), an address relating to a decentralized identifier and the access token; - sending (29), by the first server, to a ledger (112), a request for getting a decentralized identifier along with the decentralized identifier address; - sending (212), to the first server, the decentralized identifier including the public key; - generating (214) a challenge; - encrypting (216) the challenge using the public key; - sending (218), through a second server (18), to the first device, the encrypted challenge and the access token, an address relating to the second server being identified by using the decentralized identifier; - verifying (224) whether the received access token is or is not the generated access token; - decrypting (226), only in the affirmative, the encrypted challenge using the private key; - sending (228), directly or through the second server, to the first server, the challenge; - verifying (230), whether the received challenge is or is not the generated challenge; and - attesting (232), only in the affirmative, that the decentralized identifier includes data that belongs to a user or an entity. The invention also relates to corresponding first device, first and second server and system.