Decentralized Identity Management via Deterministic Key Regeneration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current decentralized and centralized identity management solutions face challenges such as insecure password-based security, centralization of sensitive data, high risk of data loss, and manipulation of transaction information, with cryptographic keys being a lucrative target for attackers and excessive storage of user information.
Innovation Solution
A method for decentralized identity management involving deterministic secret key generation based on start information, encryption of user data subsets, distributed storage, and regeneration of the secret key for decryption, ensuring secure and confidential storage without centralization and minimizing attack risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored for secure decryption, then data security is improved, but the system becomes vulnerable to attacks targeting stored keys
Solution Approach 1:
The user information is divided into multiple subsets that are distributed across different storage locations. Each subset alone is insufficient for decryption; the system requires regeneration of the secret key using the original start information to decrypt any subset. This segmentation eliminates the need to store the secret key while maintaining security.
Solution Approach 2:
The secret key is discarded after encryption and never stored. When decryption is needed, the secret key is regenerated deterministically from the original start information (such as biometric data or other secure inputs). This allows the system to recover the key temporarily for decryption while maintaining that the key was never stored, eliminating the attack vector of stored keys.
2Ease of operation
If all user information is stored in one centralized location, then data access is simplified, but the risk of data loss and security breaches increases
Solution Approach 1:
User information is divided into multiple subsets and distributed across different storage locations in the network. The system maintains ease of access by allowing decryption of any single subset through regeneration of the secret key from the start information, while security is improved because no single location contains all user data or the secret key.
3Reliability
If decentralized storage is implemented, then security against centralized attacks is improved, but transaction information manipulation becomes more difficult to detect
Solution Approach 1:
The patent implements a mechanism where the secret key generation process provides feedback verification. The deterministic regeneration of the secret key from the start information serves as a feedback mechanism to verify the integrity of the decryption process. Additionally, the system can verify that decrypted information corresponds to valid user data by checking against the regenerated key, providing feedback on transaction information integrity.
4Adaptability or versatility
If service providers receive comprehensive user information, then service quality is improved, but unnecessary data exposure increases security risks
Solution Approach 1:
The system divides user information into subsets and allows service providers to access only the specific subsets needed for their services. The secret key regeneration mechanism enables selective decryption of relevant information while keeping other user data encrypted and inaccessible, thus providing service quality without unnecessary data exposure.
Data Source
Figure 1~2
AI summary
The present invention relates to a method for decentralized user identity management, which enables user data to be stored securely, and in particular confidentially. Furthermore, the user does not need to remember a password, and consequently, the proposed method exhibits high user acceptance. The invention further relates to a correspondingly configured system arrangement and to a computer program product with control commands that implement the proposed method and/or operate the system arrangement.