Distributed Digital Signature System with Biometric Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Digital signature systems face challenges in managing signing keys, leading to risks of key loss and compromise, which can result in security breaches and improper signature generation.
Innovation Solution
A digital signature system that employs a distributed signing process using two signature generation apparatuses, each equipped with a processor, memory, and communication interface. The system generates auxiliary data based on biometric information and distributed keys, allowing for the reconstruction of a signing key and enabling secure signature generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single signing key is used for digital signature, then signature generation is simple and fast, but the risk of key loss or compromise increases
Solution Approach 1:
The signing key is segmented into multiple parts (first signing key and second signing key) that are distributed to different signature generation apparatuses. Each apparatus holds only a portion of the key, making it impossible to compromise the entire signing key through a single point of failure. This segmentation directly addresses the security vulnerability of single-key systems while distributing management responsibility.
Solution Approach 2:
The system implements a hierarchical key structure where the original signing key is nested within a distributed key pair system. The first and second signing keys are nested components that collectively reconstruct the original signing capability. This nested structure allows secure key reconstruction only when both components are present, preventing unauthorized access while maintaining functional equivalence to the original key.
2Ease of operation
If biometric information is used to generate signing keys, then key management becomes easier, but the risk of biometric compromise increases and cannot be reversed
Solution Approach 1:
The biometric-based signing capability is segmented into multiple independent components (first signing key from first biometric information, second signing key from second biometric information). This segmentation ensures that compromise of one biometric component does not result in total system compromise, as the other component remains secure and can prevent unauthorized signature generation.
Solution Approach 2:
The system prepares multiple independent signing key pairs in advance, each derived from different biometric information sources. This beforehand cushioning creates a safety buffer where if one biometric source is compromised or becomes unavailable, the system still has other secure signing capabilities, preventing total loss of signature functionality.
3Reliability
If multiple signing keys are distributed to different apparatuses, then security against key loss is improved, but the signature generation process becomes more complex
Solution Approach 1:
The first and second signature generation apparatuses are merged into a coordinated signing system where they jointly generate signatures. The apparatuses combine their respective signing keys through a collaborative protocol to produce a valid digital signature, achieving secure distributed signing while maintaining process efficiency through predefined merging procedures.
Solution Approach 2:
The system performs preliminary key distribution and apparatus configuration before the actual signing process. The first and second signing keys are pre-distributed to their respective apparatuses, and the collaborative signing protocol is pre-established. This preliminary action reduces the complexity during actual signature generation, as the apparatuses only need to execute the pre-defined collaborative routine rather than establishing complex interactions in real-time.
Data Source
AI summary
A first signature generation apparatus receives and registers first auxiliary data generated based on a first signature key and first biometric information and a second signature generation apparatus acquires second biometric information, generates a second distributed key, generates second auxiliary data using the second biometric information and the second distributed key and transmits a message and the second auxiliary data to the first signature generation apparatus, which generates a first distributed key using the first auxiliary data and the second auxiliary data, wherein the first and second signature generation apparatuses execute a distributed signing process using at least the first and second distributed keys to generate a signature for the message.