Encrypted Private Key Hosting for Secure Cloud Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing private keys on client devices are prone to loss, leading to service disruption and significant user losses when the private key is misplaced or forgotten.
Innovation Solution
A data processing method where the private client key is encrypted using an object password and stored as encrypted data, with the encrypted data being hosted on a cloud device, allowing recovery and secure service processing through a secure execution environment isolated from the client, ensuring the private key remains confidential and secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the private key is stored locally on the client device, then the user has direct access and control, but the risk of loss or theft increases significantly
Solution Approach 1:
The patent extracts the private key from the client device and stores it remotely on a server. The client only retains the encrypted form and decryption capability through biometric authentication, eliminating the risk of physical loss or theft of the private key while maintaining secure access.
Solution Approach 2:
The patent introduces a server as an intermediary between the user and the private key. The server stores the encrypted private key and mediates access through biometric authentication, preventing direct exposure of the private key to the client device while enabling secure retrieval when needed.
2Reliability
If the private key is encrypted and stored on a server, then security is improved, but the complexity of key management and retrieval processes increases
Solution Approach 1:
The patent implements self-service through biometric authentication, where the user's own biometric data serves as the decryption key. This eliminates the need for complex password management or external authentication systems, simplifying the user experience while maintaining high security standards.
Solution Approach 2:
The patent performs preliminary encryption of the private key on the server before storage. This pre-encryption step simplifies subsequent retrieval operations, as the key is already in a secure format ready for biometric-based decryption without requiring complex transformation processes at retrieval time.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Disclosed in the present application are a data processing method and apparatus, and a program product, a computer device and a medium. The method is applied to a terminal device, which comprises a first client, the first client has a client public key and a client private key, and the first client stores encrypted data, which is obtained after the client private key is encrypted according to an object password. The method comprises: in response to the acquisition of a cloud hosting request for encrypted data, receiving an object password; decrypting the encrypted data by using the received object password, so as to obtain a client private key; signing for the encrypted data on the basis of the client private key, so as to obtain a signature of the encrypted data; and sending a client public key, the encrypted data and the signature of the encrypted data to a cloud device of a first client, so that the cloud device stores the encrypted data after successfully verifying the encrypted data on the basis of the client public key and the signature of the encrypted data. By means of the present application, the reliability and security of the keeping of a client private key can be improved.