Emergency Account Key Recovery for Encrypted Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in securely restoring access to stored data when credentials become unrecoverable, leading to resource wastage and potential data compromise due to unauthorized access.
Innovation Solution
A stateless system employing a client application and infrastructure that encrypts and stores data using a unique key arrangement, allowing access restoration through an emergency account without storing unencrypted data, thus preventing unauthorized decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a traditional data storage system stores unencrypted data for easy access restoration, then access restoration becomes simple and fast, but security is compromised and unauthorized access becomes possible
Solution Approach 1:
The system performs preliminary encryption of data before storage, and pre-establishes emergency contact information and encryption keys. When access restoration is needed, the encrypted data can be safely transmitted to emergency contacts who possess the necessary decryption credentials, eliminating the need to store unencrypted data while enabling quick restoration.
Solution Approach 2:
The system introduces emergency contacts as intermediaries between the user and the encrypted data. These contacts serve as trusted mediators who can facilitate access restoration by providing decryption keys or authorized access credentials, thereby enabling secure access restoration without compromising data security.
2Object-affected harmful factors
If encrypted data is stored without accessible decryption keys, then security is maintained, but access cannot be restored when credentials are lost
Solution Approach 1:
The system performs preliminary distribution of encryption keys to trusted emergency contacts before the user loses access. This ensures that decryption capability is already in place and can be immediately activated when needed, maintaining both security and restorability.
Solution Approach 2:
The system changes the state of key accessibility by storing encryption keys in an encrypted form that can only be decrypted by specific emergency contacts with authorized credentials. This allows the system to maintain data security while enabling controlled access restoration through parameter changes in key management.
3Productivity
If unencrypted data is transmitted during access restoration, then restoration speed is improved, but data loss and unauthorized access risks increase
Solution Approach 1:
The system performs preliminary encryption of data before transmission during the restoration process. This allows encrypted data to be transmitted immediately without delay for encryption operations, maintaining fast restoration speeds while ensuring data protection throughout the transmission process.
Solution Approach 2:
The system uses emergency contacts as secure intermediaries who receive and transmit encrypted data. These intermediaries ensure that data remains protected during transmission and only decrypt it in secure environments, thereby maintaining both restoration speed and data protection.
Data Source
AI summary
A method including receiving, by an infrastructure device from a first user device, encrypted content and an encrypted first private key for storage in association with a first account registered by the first user device with the infrastructure device; receiving, by the infrastructure device from the first user device, identification information identifying a second user device; receiving, by the infrastructure device from the second user device, a restoration request to access the first account based at least in part on a determination that the first user device is unable to access the stored encrypted content; and enabling, by the infrastructure device based at least in part on receiving the identification information and the restoration request, access of the second user device to the encrypted content and the encrypted first private key to enable the second user device to decrypt the encrypted content is disclosed. Various other aspects are contemplated.