Digital Signature Security via Distributed Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often face challenges in electronically identifying themselves without access to a smart card or electronic device, particularly in situations where they cannot carry additional items or are in untrusted networks.
Innovation Solution
A method and system that generate and store strong cryptographic parameters from weak security parameters like passwords, using a plurality of remote servers to derive key portions without compromising the user's security, ensuring secure digital signatures over untrusted networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a smart card or electronic device is used to hold a private signing key, then digital signature security is improved, but device portability and ease of operation deteriorate
Solution Approach 1:
The patent extracts the private signing key from physical storage devices (smart cards, electronic devices) and stores it instead in a remote database. This allows users to access their signing keys remotely without carrying physical devices, resolving the contradiction between security and portability by separating the key storage location from the user's physical possession.
Solution Approach 2:
The patent introduces a remote database as an intermediary between the user and the private signing key. The database acts as a mediator that securely stores the key and provides controlled access to users, eliminating the need for users to physically carry smart cards or electronic devices while maintaining security through centralized, protected storage.
2Ease of operation
If a remote database is used to store a private signing key, then device portability is improved, but security against attacks deteriorates
Solution Approach 1:
The patent segments the private signing key into multiple portions and distributes them across multiple remote databases. No single database holds the complete key, so compromising one database does not expose the entire key. This segmentation strategy maintains portability while improving security against database attacks.
Solution Approach 2:
The patent implements preemptive security measures by encrypting the private signing key with the user's public key before storing it in the remote database. This prior cushioning ensures that even if the database is compromised, the key remains protected. The system also prepares backup key portions in multiple databases in advance to withstand potential attacks on any single database.
3Reliability
If multiple remote servers are used to store key portions, then security against brute-force attacks is improved, but system complexity increases
Solution Approach 1:
The patent divides the private signing key into multiple portions and stores each portion in a different remote database. This segmentation increases security against brute-force attacks because an attacker would need to compromise multiple databases and combine all key portions to reconstruct the full key. The system manages this complexity through automated key management protocols.
Solution Approach 2:
The patent combines multiple remote databases into a distributed key storage system that functions as a unified security mechanism. While the physical infrastructure is distributed, the system presents a unified interface to users and automatically manages the complexity of coordinating multiple databases, thereby improving security without significantly increasing user-facing complexity.
Data Source
AI summary
A digital signature method, a method for initializing a digital signature scheme, a system for digitally signing a message and a computer program product are described. At least the digital signature method involves a signer having a weak security parameter. The signer retrieves a cryptographic element from each of a plurality of computing entities. Each cryptographic element is a function of a commitment supplied by the signer and the commitment includes a cryptographic function of a weak security parameter provided by the signer. A strong cryptographic security parameter is generated using a plurality of said elements. A message is then signed according to the digital signature scheme using the strong cryptographic security parameter to generate a digital signature.