Distributed Credential Storage With Key Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized storage of user credentials in network environments poses a significant security risk, as malicious entities can access and exploit this information for unauthorized actions, and existing fortification measures are inadequate against sophisticated attacks.
Innovation Solution
Decentralize the storage of encrypted user credentials across multiple devices, ensuring that the encryption keys are kept separate from the credentials, thereby preventing unauthorized access and usage, even if one location is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user credentials are stored in a centralized location (server), then authentication processes can provide protection against unauthorized usage, but malicious entities can attempt unauthorized retrieval and usage of the private information
Solution Approach 1:
The patent segments the credential storage system into multiple distributed devices rather than a single centralized server. Each device stores encrypted credentials, and no single device holds both the encrypted credentials and the decryption key. This segmentation prevents malicious entities from retrieving complete credentials by compromising a single location, thereby maintaining authentication security while reducing unauthorized access risk.
Solution Approach 2:
The patent extracts the decryption key from the credential storage location. The key is stored separately from the encrypted credentials on different devices. This extraction ensures that even if an attacker compromises the device storing encrypted credentials, they cannot decrypt the credentials without the separately stored key, thus preventing unauthorized usage while maintaining the authentication function.
2Object-affected harmful factors
If encrypted credentials are stored on user devices without the encryption key, then malicious actors cannot access both the key and encrypted credentials by breaking into a single location, but the system complexity increases due to distributed storage management
Solution Approach 1:
The patent divides the credential storage system into multiple segments distributed across different user devices. Each segment contains encrypted credentials, and the decryption key is stored separately on a different device. This segmentation eliminates the attack vector of compromising a single centralized storage location, while the distributed architecture inherently manages complexity by avoiding single-point failure and centralization bottlenecks.
Data Source
AI summary
Described embodiments provide systems and methods for securely storing private information of a user on a device of the user. A server may register a mobile device to store credentials of a user thereon, based on authentication of the user of the mobile device. The server may encrypt credentials of the user using a key of the server. The server may send the encrypted credentials to the registered mobile device for storage thereon without the key. The server may send a code to an endpoint device to initiate authentication of the user with use of the mobile device. The server may receive the encrypted credentials from the mobile device in response to the authentication. The server may decrypt the encrypted credentials using an encryption key of the server. The server may send the decrypted credentials to the endpoint device to authenticate the user at the endpoint device.