Distributed Key Shares for Low-Latency Multi-Party Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge of securely managing cryptographic keys in cloud computing environments, where the risk of key theft and increased latency hinder efficient cryptographic operations, especially when third-party cloud providers are involved, is addressed by distributing key shares using a three-party Yao protocol and garbled circuits.
Innovation Solution
A method where a key management computer generates and distributes cryptographic key shares to multiple computer nodes, ensuring each node only receives a garbled version of its own share, allowing secure multi-party encryption without exposing the entire key to the cloud environment, thus reducing reliance on hardware security modules and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the cryptographic key is stored in a hardware security module, then the security against key theft is improved, but the latency and communication overhead increase when retrieving the key for cryptographic operations
Solution Approach 1:
The cryptographic key is segmented into multiple key shares that are distributed across different hardware security modules. Instead of retrieving a single complete key, the system retrieves only the necessary key shares locally, reducing communication overhead and latency while maintaining security through the distributed architecture.
Solution Approach 2:
The system performs preliminary key share generation and distribution to multiple hardware security modules before cryptographic operations are needed. This pre-positioning of key shares allows for faster local retrieval and processing, reducing the latency that would otherwise occur during key retrieval for encryption operations.
2Ease of operation
If the cryptographic key is retrieved from the hardware security module and imported into a computing environment, then the ease of performing cryptographic operations is improved, but the risk of key theft or leakage increases
Solution Approach 1:
The key is divided into multiple shares that remain distributed in different hardware security modules. Each module performs cryptographic operations using only its local key share, eliminating the need to import the complete key into less secure computing environments while maintaining operational capability through the distributed key share architecture.
Solution Approach 2:
The hardware security module acts as an intermediary that performs cryptographic operations using locally stored key shares without exposing the complete key to the computing environment. This intermediary architecture allows cryptographic operations to be performed securely in place, preventing key theft or leakage while maintaining ease of operation.
3Reliability
If the cryptographic key remains in the hardware security module and is accessed by cloud-based applications, then the security against key theft is improved, but the latency and communication overhead greatly increase
Solution Approach 1:
The key is segmented into multiple shares distributed across different hardware security modules in the cloud infrastructure. Each module can perform cryptographic operations locally using its key share, reducing the need for repeated communication with central key management systems and improving service efficiency while maintaining security through distribution.
Solution Approach 2:
Key shares are pre-distributed to multiple hardware security modules before cryptographic operations are needed. This preliminary distribution allows cloud-based applications to access key shares locally without incurring high communication overhead, improving productivity while maintaining security through the distributed architecture.
4Ease of operation
If the cryptographic key is relinquished to a third-party cloud provider, then the ease of performing cryptographic operations in the cloud is improved, but the security control and trust are reduced
Solution Approach 1:
The key is segmented into multiple shares that are distributed across different hardware security modules, none of which contain the complete key. This segmentation allows cloud-based cryptographic operations to be performed using distributed key shares, maintaining ease of operation in the cloud while preserving security control through the distributed architecture that prevents any single entity from compromising the entire key.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for managing cryptographic keys in on-premises and cloud computing environments and performing multi-party cryptography are disclosed. A cryptographic key can be retrieved from a hardware security module by a key management computer. The key management computer can generate key shares from the cryptographic key, and securely distribute the key shares to computer nodes or key share databases. The computer nodes can use the key shares in order to perform secure multi-party cryptography.