Distributed Key Management for Secure Password Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data and access security systems are vulnerable due to the distribution of a single encryption key across multiple computers, which can compromise the entire security system if any one computer is compromised, and there is a need for isolating data protection between separate organizations within an enterprise.
Innovation Solution
A distributed key management system is implemented using a hierarchical directory service to store encryption keys, making them accessible only to high-level administrators while keeping them inaccessible to lower-level administrators, yet indirectly accessible to system components that need to access external services, ensuring secure decryption and access to encrypted passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single encryption key is distributed to multiple computers for data access, then data accessibility is improved, but security reliability deteriorates because compromise of any one computer exposes the entire system
Solution Approach 1:
The patent divides the single encryption key into multiple key segments distributed to different computers. Each computer holds only a portion of the key, making it impossible to decrypt data alone. The full encryption key is reconstructed only when all key segments are combined through a distributed key management system, thus maintaining security while enabling data access across multiple systems.
2Device complexity
If a single encryption key is stored in a directory service accessible to high-level administrators, then key management is simplified, but security control deteriorates because lower-level administrators cannot access the key yet system components need it
Solution Approach 1:
The patent introduces a distributed key management system as an intermediary layer between the directory service and system components. This mediator retrieves key segments from the directory service, combines them to reconstruct the full encryption key, and provides it to authorized system components without exposing the key storage location to lower-level administrators. This resolves the conflict between simplified key management and flexible access control.
Data Source
AI summary
Architecture that stores specific passwords on behalf of users, and encrypts the passwords using encryption keys managed by a distributed key management system. The encryption keys are stored in a directory service (e.g., hierarchical) in an area that is inaccessible by selected entities (e.g., administrative users) having superior permissions such as supervisory administrators, but accessible to the account components that need to access the unencrypted passwords. The distributed key management system makes the encryption key stored in the directory service available to all hardware/software components that need the key to encrypt or decrypt the passwords.