Distributed Cryptographic Key Storage with Multi-Device Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for storing cryptographic keys with encrypted data face challenges in maintaining key security and simplicity, as keys need to be preserved throughout the lifetime of encrypted information, and external mechanisms are often required to manage these keys.
Innovation Solution
A method where cryptographic keys are distributed and stored across multiple storage devices, with each device holding only a portion of the key necessary for decryption, ensuring that the entire key can only be accessed if all devices are accessible, thus eliminating the need for external key management systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored externally to encrypted data, then key management security is improved, but system complexity increases due to additional key management infrastructure
Solution Approach 1:
The patent combines key storage with data storage by storing encrypted keys on the same storage devices as the encrypted data. This eliminates the need for separate key management appliances while maintaining security through the encryption mechanism.
Solution Approach 2:
The patent extracts the key management function from separate infrastructure and integrates it into the data storage system itself. By storing keys on the same devices as data, the system removes the need for external key management appliances.
2Device complexity
If cryptographic keys are stored on the same storage devices as encrypted data, then system simplicity is improved, but security risk increases due to potential unauthorized key access
Solution Approach 1:
The patent segments the key into multiple portions and stores them on different storage devices. To reconstruct the full key, all portions must be retrieved, which requires authorized access to multiple devices. This segmentation prevents unauthorized reconstruction of the key from a single device.
Solution Approach 2:
The patent applies encryption to the keys before storing them on the storage devices. This preliminary encryption action ensures that even if storage devices are accessed unauthorizedly, the key portions remain protected and cannot be used without the decryption capability.
3Reliability
If multiple storage devices are required to access cryptographic keys, then security is improved through distributed key storage, but access time increases due to needing to access multiple devices
Solution Approach 1:
The patent implements dynamic key access where the system can retrieve key portions from multiple storage devices in parallel rather than sequentially. This dynamic approach maintains the security requirement of accessing multiple devices while reducing the total access time through concurrent operations.
Data Source
AI summary
The payload of a set of storage devices is encrypted using a payload key that is stored within the set of storage devices itself. However, the payload key is obtainable only if a user has access to n of the storage devices. A first set of keys can be distributed among a set of n storage devices, such that each key is usable to encrypt and/or decrypt a key stored on a different one of the n storage devices. The first set of keys is usable to encrypt portions of the information needed to regenerate another key (e.g., the payload key or a key used to encrypt the payload key). A different portion of the information needed to regenerate the other key is stored on each of the n storage devices. Accordingly, the other key cannot be obtained unless the user has access to all n storage devices.