Distributed Secret Storage for Encryption Key Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems face challenges in securely storing and managing private encryption keys, particularly in distributed environments, where keys are vulnerable to breaches and attacks, and existing solutions rely on specialized hardware or centralized storage, which can be costly and insecure.
Innovation Solution
A distributed-secure-storage system (DSS) that partitions secrets into multiple shares and distributes them among nodes, allowing agents to reconstruct the secret without persistently storing the original, using a polynomial encoding method and periodic refresh of shares to enhance security and resilience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private encryption keys are stored in centralized or specialized hardware, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent divides the private encryption key into multiple secret shares and distributes them across multiple nodes in a distributed network. No single node stores the complete key, eliminating the need for specialized hardware security modules while maintaining security through mathematical reconstruction requirements.
Solution Approach 2:
The patent introduces polynomial encoding as an intermediary mathematical mechanism that transforms the secret into distributable shares. This intermediary layer enables secure distribution without requiring direct trust in any single storage node or specialized hardware.
2Reliability
If secrets are distributed among multiple nodes, then security is improved, but system complexity increases
Solution Approach 1:
The patent creates universal protocols and data structures that work across all nodes in the distributed system. Standardized share formats, reconstruction algorithms, and refresh mechanisms provide multi-functional capabilities that simplify node implementation while maintaining distributed security.
Solution Approach 2:
The patent transforms the secret into different parameter representations through polynomial encoding. The secret s becomes coefficients of a polynomial, which are then evaluated at different points to create shares. This parameter transformation enables simple arithmetic operations on shares while preserving the original secret's security properties.
3Reliability
If secret shares are periodically refreshed, then security is improved, but loss of time occurs during refresh operations
Solution Approach 1:
The patent performs preliminary polynomial encoding and share generation during system initialization. Subsequent refresh operations only require generating new random polynomials and redistributing shares, avoiding time-consuming secret reconstruction and re-encoding processes.
Solution Approach 2:
The patent implements periodic refresh of secret shares at predetermined intervals. This periodic action maintains security by preventing long-term exposure of static shares while using efficient refresh protocols that minimize disruption to system operations.
Data Source
AI summary
The current document is directed to distributed-secure-storage systems, and processes carried out within the distributed-secure-storage systems, that provide for secure storage and retrieval of secrets within distributed computer systems, including private encryption keys used for client authentication during establishment of secure communications channels. The secret-storage systems partition an input secret into multiple secret shares and distribute the secret shares among multiple secret-share-storing node subsystems, without persistently storing the secret itself. An agent within a client device subsequently requests a secret share corresponding to a secret, or a share of data derived from the secret share, from each of the multiple secret-share-storing nodes. Each secret-share-storing node transmits the requested secret share or derived-data share to the agent, which reconstructs the secret from all or a portion of the secret shares or a data value from all or a portion of the derived-data shares transmitted to the agent.