Delegated Key Access for Secure Cryptographic Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptographic systems require direct access to cryptographic keys for performing operations on large-scale datasets, making them vulnerable to key replication or sharing with unauthorized users, thus compromising security.
Innovation Solution
A computer-implemented method using a high-trust environment with a compute service and key storage service, where user requests for cryptographic operations are processed without revealing the cryptographic key or algorithm, by using user tokens and compute service tokens to authenticate and authorize access, ensuring secure delegation of cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users have direct access to cryptographic keys for performing operations on large-scale datasets, then ease of operation is improved, but security deteriorates due to key replication or sharing with unauthorized users
Solution Approach 1:
The patent introduces a key storage service as an intermediary between users and cryptographic keys. Users interact with the key storage service through controlled interfaces rather than having direct access to keys. The service authenticates users, manages key distribution, and enables cryptographic operations without exposing keys to users, thus resolving the contradiction between ease of operation and security.
2Productivity
If cryptographic keys are made accessible to users for performing operations, then productivity is improved, but loss of information worsens as keys may be replicated or shared unauthorizedly
Solution Approach 1:
The key storage service acts as a mediator that provides cryptographic keys to authenticated users through controlled mechanisms. The service enables users to perform cryptographic operations efficiently while maintaining strict control over key distribution and usage, preventing unauthorized replication or sharing and thus avoiding information loss.
Solution Approach 2:
The system performs preliminary authentication and authorization actions before providing access to cryptographic keys. Users must be authenticated and authorized by the key storage service before receiving keys or performing operations, ensuring that only legitimate users can access cryptographic information while maintaining high productivity.
3Reliability
If a centralized key access control system is implemented, then security is improved by restricting key access, but device complexity increases due to multiple services and authentication mechanisms
Solution Approach 1:
The key storage service is designed as a universal multi-functional system that handles authentication, authorization, key distribution, and cryptographic operation coordination. By consolidating these functions into a single service, the system improves security through centralized control while avoiding the complexity that would arise from multiple separate services.
Data Source
AI summary
An apparatus, computer-implemented method and computer program are disclosed for performing a cryptographic operation in a high-trust (HT) environment. The HT environment including a compute service and key storage service. The compute service receives from a user device, a user request for performing a cryptographic operation on at least a portion of a large-scale dataset. The user request including a user token associated with a user of the user device. The compute service sends to the key storage service, a cryptographic key access request corresponding to the received user request. The cryptographic key access request including data representative of the user token and/or a compute service token. The key storage service determines from the user token and/or compute service token whether the user has permission to have the cryptographic operation performed and/or whether to grant the compute service access to data representative of the cryptographic key in relation to the requested cryptographic operation when user has permission. In response to the key storage service granting access to the compute service, the key storage service sends to the compute service the requested cryptographic key/algorithm associated with the cryptographic operation of the user request. The compute service performs the cryptographic operation on the portion of the large-scale dataset based on the received cryptographic key/algorithm.