Dual Encryption Key Recovery via Remote Unlock
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption key recovery methods fail to allow users to retrieve encrypted master keys if they forget the user-supplied password, resulting in inaccessible encrypted databases and potential loss of data.
Innovation Solution
A dual encryption method is implemented, where a master key is encrypted with both a user-provided password and an unlock key, with the unlock key stored remotely and accessible only through secure, authenticated connections from devices within a local network, and requiring physical presence verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a master key is encrypted with only a user-provided password, then the encryption scheme is simple, but the user cannot recover the key if they forget the password
Solution Approach 1:
The encryption scheme is segmented into two independent parts: password-based encryption and unlock key encryption. The master key is encrypted with both a user-provided password and a separate unlock key, allowing recovery through either method independently. This segmentation resolves the contradiction by providing redundant recovery paths without requiring the entire encryption system to become significantly more complex.
Solution Approach 2:
The unlock key is generated and stored in advance on a remote server before the user may forget their password. This preliminary preparation enables future key recovery without requiring complex real-time authentication processes, thus improving reliability while maintaining acceptable complexity levels.
2Reliability
If the unlock key is stored on the same device as the encrypted master key, then access is fast, but security is compromised
Solution Approach 1:
A remote server acts as an intermediary between the user's device and the encrypted master key. The unlock key is stored on this remote server, which communicates securely with the user's device. This intermediary approach maintains security by separating the unlock key from the encrypted data while enabling convenient access through authenticated communication channels.
3Ease of operation
If the unlock key is stored remotely, then security is improved, but access requires network connection and authentication
Solution Approach 1:
The remote server provides multiple functions: storing the unlock key, authenticating user requests, and facilitating secure communication. This multi-functionality consolidates what would otherwise require multiple separate components into a single accessible service, improving ease of operation while managing complexity through a unified system.
Data Source
AI summary
A system and method for supporting encryption key retrieval. A first digital key is created. A first protected key is created by applying a first protection algorithm based on a first user provided password to the first digital key. A first unlock key is created that is separate from the first digital key. A second protected key is created by applying a second protection algorithm based on the first unlock key to the first digital key. The first protected key and the second protected key are stored. The first unlock key is sent to a remote storage and no copy of the unlock key is retained after the sending the first unlock key.