Decentralized Identity Data Management via Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face vulnerabilities in storing and managing identity data due to reliance on centralized data management hubs, which can lead to data breaches and exposure of sensitive information if compromised.
Innovation Solution
Implementing a decentralized management system where identity data is encrypted and stored on a data management hub without revealing plaintext values, allowing users to securely verify themselves to target devices or services without exposing sensitive data to the hub.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store identity data in a centralized data management hub, then data management and access are simplified, but security and vulnerability to data breaches increase
Solution Approach 1:
The system segments the cryptographic key into two separate parts: a first part stored with the encrypted data at the data management hub, and a second part stored in the user's digital wallet. This segmentation ensures that no single entity possesses the complete key, thereby preventing complete data decryption even if one storage location is compromised.
Solution Approach 2:
The patent introduces an intermediary verification process where the user's digital wallet verifies the authenticity of data requests before providing access. The digital wallet acts as a mediator that controls whether data is released, ensuring that even though data is stored at the hub, the user maintains security through their digital wallet's verification mechanism.
2Ease of operation
If users entrust storage of sensitive information to a data management hub, then storage and access are centralized and simplified, but control over security measures is lost
Solution Approach 1:
The user's digital wallet performs self-service security verification by independently validating data requests before accessing the data management hub. The digital wallet uses its own stored verification keys to authenticate requests, eliminating the need for users to manually configure security measures while maintaining full security control.
Solution Approach 2:
By segmenting the cryptographic key into parts stored at different locations (hub and user device), the system maintains centralized storage convenience while distributing security control. The user retains control over their portion of the key stored in their digital wallet, preventing complete loss of security control to the hub.
3Speed
If plaintext identity data is stored at the data management hub, then data retrieval and verification are fast and simple, but exposure of sensitive information occurs during breaches
Solution Approach 1:
The system performs preliminary encryption of identity data before storage at the data management hub. Data is encrypted using a cryptographic key split into two parts, with the first part stored at the hub and the second part in the user's digital wallet. This preliminary encryption action prevents data exposure during breaches while maintaining efficient retrieval through the encrypted storage mechanism.
Solution Approach 2:
The encrypted data acts as an intermediary between the raw plaintext data and the storage location. The data management hub stores and processes only encrypted data, while the user's digital wallet holds the verification mechanism. This intermediary encrypted form maintains data accessibility while preventing direct exposure of plaintext sensitive information.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed embodiments relate to securely facilitating decentralized management of identity data. Operations may include receiving, from an identity, encrypted data and an index associated with the encrypted data; receiving, from the identity, a first request including: the index, a first part of a first cryptographic key, and a target service cryptographic key; identifying, using the index, the encrypted data; encrypting a copy of the encrypted data using the target service cryptographic key to form a doubly encrypted data; sending a challenge token to the identity; receiving a second request, from a target service, the second request including: the index and a challenge response created based on the challenge token; and sending to the target service the doubly encrypted data and the first part of the first cryptographic key; wherein the target service is operable to decrypt the doubly encrypted data.