Decryption Key Segmentation and External Storage for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in securely storing and managing decryption keys, particularly in preventing unauthorized access when computing devices are stolen, as storing keys on the device or hardware security modules can be vulnerable to attacks.
Innovation Solution
A system where a decryption key is encrypted with a storage key and stored on a separate computing device, with authentication using private and public authentication keys, allowing secure decryption of encrypted data while minimizing exposure of the decryption key on the primary device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the decryption key is stored on the computing device or hardware security module, then data can be decrypted and accessed, but the system becomes vulnerable to unauthorized access when the device is stolen or compromised
Solution Approach 1:
The decryption key is segmented into multiple parts and distributed across different key servers. Each key server holds a portion of the key, and no single server possesses the complete decryption key. This segmentation ensures that even if one key server is compromised, the entire key cannot be reconstructed, thereby preventing unauthorized access while maintaining data accessibility.
Solution Approach 2:
The decryption key is extracted from the computing device and stored externally on separate key servers. The key management functionality is separated from the data storage and processing functions. This extraction eliminates the vulnerability of storing keys on the device itself, as keys are now maintained in a centralized, secure key management infrastructure that can provide controlled access without requiring local key storage.
2Reliability
If the decryption key is stored on a separate key server, then security is improved by preventing key exposure on the device, but the system complexity increases due to key management infrastructure
Solution Approach 1:
The key server infrastructure provides multiple functions: secure key storage, key distribution, key rotation, and access control. By consolidating these functions into a universal key management system, the patent reduces overall system complexity compared to implementing separate solutions for each function. The key servers act as universal authorities that handle all cryptographic key operations, simplifying the architecture despite the added security layer.
Solution Approach 2:
The key server acts as an intermediary between the computing device and the encrypted data. Instead of the device directly managing keys or storing them locally, the key server mediates key access by providing decryption keys only when proper authentication and authorization are verified. This intermediary role simplifies device complexity by offloading key management responsibilities to a specialized external service.
3Reliability
If authentication is performed using private and public keys, then access control is strengthened, but the authentication process and system overhead increase
Solution Approach 1:
Public-private key pairs are generated and registered in advance with the key server before actual data access is needed. The authentication credentials are pre-configured and stored securely. When access is required, the authentication process simply verifies pre-established credentials rather than performing complex key generation and exchange procedures, significantly reducing authentication time while maintaining strong security.
Solution Approach 2:
The public key is distributed and stored on the key server, while the private key remains on the client device. This copying of the public key to the authentication authority enables rapid verification without requiring the private key to be transmitted or stored on the server. The copying of cryptographic credentials to appropriate locations allows for efficient authentication while maintaining the security benefits of asymmetric cryptography.
Data Source
AI summary
A system and a method are provided for retrieving decryption keys from a secure location that is separate from the encrypted data. In particular, for each decryption key, there is an associated key ID, public and private authentication key pair and a storage key. The decryption key is encrypted and can be decrypted with the storage key. A key-server securely stores the encrypted decryption key, key ID and public authentication key. A separate key-host stores the storage key, key ID and private authentication key. For the key-host to retrieve the encrypted decryption key, the key-server first authenticates the key-host using the authentication keys. Upon receipt of the encrypted decryption key, the key-host decrypts the encrypted key using the storage key. The decryption key is then used for decrypting the encrypted data.