Distributed Encryption Key Management via Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption schemes face challenges in securely storing and recovering cryptographic keys, especially in blockchain-based technologies, where loss or theft of private keys can result in irreversible loss of valuable assets, and there is a need for a method that allows data to be stored in a recoverable manner while maintaining security against unauthorized access.
Innovation Solution
A method is introduced that generates multiple shares of a data element, encrypts each share with a respective encryption key, and outputs these encrypted shares, allowing multiple users to securely store and recover the data without compromising security, even if some shares are lost, by using a secure microcontroller and secure memory components to manage decryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using a single encryption key, then security is maintained, but the risk of irreversible loss increases if the key is lost
Solution Approach 1:
The single encryption key is segmented into multiple key shares using secret sharing schemes. Each share alone is insufficient to decrypt the data, but a threshold number of shares can reconstruct the original key. This segmentation allows the system to maintain security while enabling recovery through distributed key management.
Solution Approach 2:
A trusted intermediary system or protocol is introduced to manage the distribution and reconstruction of key shares. This intermediary facilitates secure key recovery by coordinating between multiple parties without exposing the full encryption key, thus enabling data recoverability while maintaining security.
2Loss of information
If multiple copies of encryption keys are stored for backup, then data recoverability is improved, but security against unauthorized access deteriorates
Solution Approach 1:
Instead of storing multiple complete copies of the encryption key, the key is segmented into multiple shares distributed to different storage locations or parties. Each share alone is useless for decryption, eliminating the security risk of unauthorized access while maintaining recoverability through the threshold mechanism.
Solution Approach 2:
Different key shares are stored with different security characteristics and access controls. Each share can be protected by different methods (e.g., hardware security modules, encrypted storage, physical security), allowing tailored security measures for each location while collectively providing both security and recoverability.
3Reliability
If encryption keys are distributed among multiple users, then security against single point of failure is improved, but system complexity increases
Solution Approach 1:
A universal key management protocol is implemented that handles key generation, distribution, and reconstruction through a standardized process. This multi-functional approach consolidates multiple key management operations into a single framework, reducing operational complexity despite the distributed nature of the system.
Solution Approach 2:
The system incorporates feedback mechanisms that automatically track which key shares are available and coordinate their combination. This automated feedback loop simplifies the management complexity by eliminating manual coordination overhead and providing real-time status monitoring of key availability.
Data Source
AI summary
A method comprises generating, based on a data element, M data element shares, wherein M is an integer greater than 1; providing each of M encryption keys to a first data processing unit; the first data processing unit encrypting each of the M data element shares with an encryption key, respectively, and thus generating M encrypted data element shares, wherein each of the encryption keys corresponds to a decryption key, respectively.