Passwordless Decryption via Distributed Key Shards
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data encryption systems face challenges in securely managing and accessing large volumes of data-at-rest due to password and key management complexities, vulnerabilities from single master passwords, and the risk of key loss or theft, leading to inadequate encryption of data.
Innovation Solution
A passwordless encryption system using a combination of symmetric cryptography, asymmetric cryptography, and threshold cryptography, where data is encrypted with unique cryptographic keys and shards are distributed across multiple devices, allowing decryption without requiring the entire key, thus enhancing security and accessibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single device holds encryption keys, then key management is simple, but security is vulnerable to key loss or theft
Solution Approach 1:
The encryption key is divided into multiple shards distributed across different devices. No single device holds the complete key, so security is improved while avoiding the vulnerability of centralized key storage. The key management complexity is distributed rather than eliminated, but this enables threshold-based access control.
Solution Approach 2:
The system uses nested encryption where encrypted shards are stored within data structures that also contain decryption instructions. The shards themselves are encrypted with public keys, creating layers of protection that resolve the security-complexity contradiction through structured organization.
2Reliability
If multiple devices are needed to decrypt a file, then security is improved, but determining which devices to request assistance from becomes complex
Solution Approach 1:
The system performs preliminary actions by pre-distributing encrypted key shards to multiple devices before encryption is needed. Each device is pre-configured with its shard and the public keys of other devices, so when decryption is required, the coordinating device can immediately begin requesting shards without complex real-time key management decisions.
Solution Approach 2:
The patent introduces an intermediary coordination device that manages the decryption process. This mediator handles the complexity of coordinating multiple devices by sequentially requesting shards until the threshold is met, simplifying the operation for end users while maintaining security through distributed key storage.
3Reliability
If key shards are distributed across multiple devices, then security against key loss is improved, but the decryption process requires coordination between devices
Solution Approach 1:
The system changes parameters by allowing flexible configuration of the threshold number of shards required for decryption. This enables optimization between security and decryption time - higher thresholds improve security against key loss but increase coordination time, while lower thresholds reduce decryption time. The public key infrastructure also changes the time parameter by enabling asynchronous shard retrieval without requiring all devices to be simultaneously available.
Data Source
AI summary
A method comprises: receiving, at a first device, a request to decrypt data encrypted with a symmetric key, the encrypted data stored on a memory device; retrieving shards of the symmetric key, the shards encrypted with public keys from a plurality of devices, wherein decryption of the data requires reconstituting the symmetric key from a threshold number of the shards; determining a priority to request decryption of the shards with private keys from the plurality of devices; requesting decryption by the plurality of devices of the shards in the determined priority until the threshold number of shards is reached; reconstituting the symmetric key from the decrypted shards; and decrypting the encrypted data with the symmetric key.