Distributed Encryption Key Management via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems rely heavily on a single secret key manager for data security, making them vulnerable to data leakage and unsuitable for environments where users lack mutual trust, as the safety of the entire system depends on the secrecy of this manager.
Innovation Solution
A distributed encryption and decryption method where each user generates a public key share and private key share, allowing for the creation of a public key through collaboration, enabling secure encryption and decryption only when all users agree, thereby distributing the secret key management authority equally among users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single secret key manager is used to manage cryptographic keys, then the system can provide stable data convergence service, but the safety of the entire system depends entirely on the safety of the secret key manager, making it vulnerable to data leakage
Solution Approach 1:
The patent divides the secret key management into multiple independent key managers, each holding a share of the master secret key. Instead of relying on a single secret key manager, the system segments the key management function across multiple entities, so that no single point of failure or compromise exists. This resolves the contradiction by maintaining reliability through distribution while avoiding the vulnerability of centralized key management.
Solution Approach 2:
The patent introduces a threshold mechanism as an intermediary layer between the key managers and the cryptographic operations. This threshold mechanism coordinates the key shares and ensures that a sufficient number of key managers must collaborate to perform cryptographic functions, providing a structured way to manage the distributed key system without requiring complete trust in any single manager.
2Ease of operation
If a single secret key manager is used, then key management is simplified, but it is not possible to set only one secret key manager that all users can trust, especially when users cannot trust each other
Solution Approach 1:
The patent segments the trust model by distributing key management responsibilities across multiple independent key managers. Each key manager manages a portion of the secret key, and users can interact with multiple key managers rather than relying on a single trusted entity. This segmentation allows users to trust the system without needing to trust any single key manager, resolving the contradiction between operational simplicity and user trust.
Solution Approach 2:
The patent applies local quality by allowing each key manager to operate independently with its own key share and operational characteristics. Each key manager can have different security policies, trust levels, or operational modes, enabling users to select and interact with key managers based on their specific trust requirements while maintaining overall system functionality.
3Reliability
If distributed key management is implemented among multiple users, then security is enhanced by preventing unauthorized data leakage, but the complexity of key generation and management increases
Solution Approach 1:
The patent segments the master secret key into multiple key shares distributed to different key managers. Each key manager independently manages its share, and the system provides structured interfaces for key generation, distribution, and recovery. This segmentation enhances data security through distribution while the structured processes manage the complexity of handling multiple key shares.
Solution Approach 2:
The patent implements feedback mechanisms in the key management process, including verification protocols to ensure correct key share distribution, threshold verification to confirm sufficient key managers are participating, and recovery procedures that provide feedback when key thresholds are not met. These feedback mechanisms guide the complex distributed key management process and reduce operational errors.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are an apparatus and method for encryption and decryption. The encryption method includes generating a public key share of a user, receiving public key shares of one or more other users from terminals of the one or more other users, generating a public key using the public key share of the user and the public key shares of the one or more other users, and encrypting plaintext using the public key.