Encrypted Data Recovery via Multi-Device Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure storage devices, such as USB memory devices, face issues with data security and accessibility, as they can be stolen and password-protected data can be cracked, leading to unauthorized access, and security measures may prevent both unauthorized and authorized users from accessing encrypted data.
Innovation Solution
A software product and method to recover encrypted data from a target secure storage device by sending a transfer command, receiving an authorization request, responding to it, and decrypting the data using encryption keys from authorized secure storage devices, which can include multiple encryption keys for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password protection is implemented on USB memory devices, then data security is improved, but authorized access becomes difficult when the password is lost or the user is unavailable
Solution Approach 1:
The encryption key is segmented into multiple parts and stored in different secure storage devices. To access the encrypted data, multiple authorization requests from different secure storage devices are required, combining their keys to reconstruct the full decryption key. This segmentation prevents single-point failure while maintaining security.
Solution Approach 2:
A recovery authorization mechanism is introduced as an intermediary between the encrypted data and the decryption process. This intermediary requires multiple authorized secure storage devices to collaborate and generate authorization requests, which are then processed to recover the original data without needing the original password.
2Ease of operation
If simple password locks are used on secure storage devices, then ease of operation is improved, but security against brute force attacks deteriorates
Solution Approach 1:
The security system is segmented so that no single password or key is sufficient for decryption. Multiple secure storage devices each hold a portion of the authorization capability, and all must work together. This eliminates the vulnerability to brute force attacks on a single password while keeping the interface simple for authorized users.
Solution Approach 2:
The security mechanism uses a composite approach combining multiple encryption keys from different secure storage devices. The encrypted data requires a composite authorization structure where multiple key components are combined, creating a security system stronger than the sum of its individual parts.
3Reliability
If multiple encryption keys are required for data recovery, then security is improved, but device complexity increases
Solution Approach 1:
The system performs self-service through automated authorization request generation and processing. When multiple secure storage devices are connected, they automatically generate and exchange authorization requests, and the recovery process is triggered automatically without requiring complex manual intervention from the user.
Solution Approach 2:
The secure storage devices are designed with multi-functionality, serving both as regular encrypted storage devices for normal operation and as authorization sources for recovery operations. The same hardware and encryption infrastructure is used for both data protection and data recovery, reducing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An exemplary software product to recover encrypted data from a target secure storage device can comprise software operational when executed by a processor to receive a recovery request to recovery the encrypted data, send a transfer command to the target secure storage device, receive an authorization request from the target secure storage device in response to the transfer command, respond to the authorization request, and receive the encrypted data from the target secure storage device.