Encrypted Key Access via Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data systems face challenges in securely accessing large amounts of sensitive data, such as genomic data, due to the impracticality of decrypting bulky data in a centralized manner using Public Key Infrastructure (PKI), which requires decryption at the user side.
Innovation Solution
A method that involves storing sensitive data encrypted with a user-specific encryption key, allowing access through a secure communication channel by retrieving and decrypting an encrypted version of the encryption key using auxiliary keys, such as passwords, and providing access to authorized users while minimizing exposure of decrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is encrypted using Public Key Infrastructure with user-specific encryption keys, then security against malicious access is improved, but the ability to provide centralized access to large amounts of data deteriorates
Solution Approach 1:
The encryption key is segmented into multiple parts through a secret sharing scheme, where the original encryption key is divided into N shares and distributed among multiple storage locations. Any M out of N shares can be combined to reconstruct the key, enabling centralized decryption capabilities while maintaining security through distributed key management.
Solution Approach 2:
The patent implements nested encryption layers where the original encryption key is first encrypted using a secret sharing scheme, and then each share is further encrypted with unique authentication credentials. This creates multiple nested security layers that must be sequentially decrypted to access the underlying sensitive data.
2Reliability
If decryption is performed at the user side to maintain security, then security control is improved, but the practicality of accessing large amounts of bulky data deteriorates
Solution Approach 1:
Instead of having users decrypt data locally, the patent inverts the approach by enabling centralized decryption at the data system. The secret sharing scheme allows the server to reconstruct the encryption key from distributed shares, reversing the traditional decryption location from client-side to server-side while maintaining security guarantees.
Solution Approach 2:
The patent introduces an intermediary key management system that mediates between the encrypted data storage and user access requests. The secret sharing scheme acts as an intermediary mechanism that enables controlled key reconstruction at the server, facilitating efficient centralized data access without compromising security.
3Reliability
If multiple decryption steps are implemented to enhance security, then protection against malicious access is improved, but the complexity of the access process increases
Solution Approach 1:
The patent performs preliminary key preparation by pre-dividing the encryption key into shares and pre-encrypting each share with unique authentication credentials during system initialization. This preliminary setup creates a structured access framework where subsequent decryption operations follow a standardized multi-step process, reducing the perceived complexity for end users.
Solution Approach 2:
The system implements self-service authentication where each user's credentials automatically authenticate and decrypt their specific key share without manual intervention. The secret sharing scheme and authentication mechanism work together to automatically retrieve and combine the necessary key shares, making the complex multi-step decryption process transparent to users.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods of providing access to sensitive data associated to a user are disclosed. These methods comprise: receiving a user request requesting the provision of access; retrieving an encrypted version of the encryption key; retrieving at least one auxiliary key; obtaining a decrypted version of the encryption key by decrypting the encrypted version of the encryption key using the at least one auxiliary key; obtaining a decrypted version of all or part of the sensitive data by decrypting all or part of the encrypted version of the sensitive data using the decrypted version of the encryption key; and providing access to the decrypted version of all or part of the sensitive data through a secure communication channel. Systems and computer program products suitable for performing said methods of providing access to sensitive data are also disclosed.