Decentralized Identity Data Management via Split Key Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face vulnerabilities when storing identity data in centralized data management hubs, as they lack control over security measures and risk exposure to data breaches, which can lead to malicious actors obtaining sensitive information.
Innovation Solution
Implementing a decentralized management system where identity data is encrypted and stored in a way that only allows authorized parties to decrypt it, using cryptographic keys split into parts, with a challenge token mechanism to ensure secure access and validation, thereby keeping the data management hub blind to plaintext values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If identity data is stored in a centralized data management hub, then data access and management is simplified, but security vulnerabilities increase and user control over sensitive information is lost
Solution Approach 1:
The cryptographic key is divided into multiple parts (first part and second part), with different parts held by different entities (identity and target service respectively). This segmentation ensures that no single entity possesses the complete key, thereby enhancing security while maintaining operational simplicity through the coordinated use of key parts.
Solution Approach 2:
The data management hub acts as an intermediary that facilitates data retrieval without having access to the plaintext cryptographic keys. It enables the target service to obtain encrypted data and coordinate key part distribution, thus simplifying data management operations while preserving security through cryptographic abstraction.
2Reliability
If identity data is encrypted and stored in a decentralized manner, then security is improved and user control is maintained, but system complexity increases
Solution Approach 1:
The cryptographic key is segmented into multiple parts distributed among different entities. This segmentation enhances security by ensuring that no single entity has full control, while the modular structure of key parts actually simplifies the overall system architecture by separating security concerns from data management operations.
Solution Approach 2:
The target service autonomously retrieves encrypted data from the data management hub and independently completes the decryption process using its key part. This self-service mechanism reduces system complexity by eliminating the need for centralized key management or complex coordination protocols, as each entity performs its function independently.
3Speed
If the data management hub has access to plaintext identity data, then data retrieval is faster, but the risk of data breaches and malicious access increases
Solution Approach 1:
The data management hub serves as a cryptographic intermediary that handles encrypted data without accessing plaintext. It mediates between the identity and target service by facilitating the transfer of encrypted data and coordinating key part distribution, thereby enabling fast data retrieval through efficient cryptographic operations while eliminating the security risk of plaintext storage.
Solution Approach 2:
The system replaces traditional plaintext storage and retrieval mechanisms with cryptographic operations. Instead of storing and accessing plaintext data, the system uses encrypted data with cryptographic key parts, substituting mechanical security measures (physical security, access controls) with mathematical security mechanisms that enable fast retrieval without compromising security.
Data Source
AI summary
Disclosed embodiments relate to securely facilitating decentralized management of identity data. Operations may include identifying a prompt to perform an attestation process for an identity; receiving, from the identity, a first request including: an index associated with encrypted data, a second part of a first cryptographic key, and a challenge token; generating a challenge response based on the challenge token; sending a second request to a data management hub including: the index and the challenge response; receiving a response to the second request, from the data management hub, the response including: doubly encrypted data formed by encrypting a copy of the encrypted data and a first part of the first cryptographic key; and decrypting the doubly encrypted data.