Encryption Credential Recovery via OAuth and Master Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to provide a seamless recovery of encrypted data stored in cloud mass storage when the user credential used for deriving encryption keys is lost, such as when a user forgets their password, making it impossible to recover previously stored data.
Innovation Solution
A method that involves authenticating the user to their encryption and storage accounts using credentials, generating and encrypting access tokens, and using a recovery master key to securely store and retrieve encryption keys, allowing for data recovery even if the original credentials are forgotten, by binding the encryption server to the storage server through an online authentication protocol like OAuth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional credential-based encryption is used where the encryption key is derived from the user password, then security is maintained through user-controlled credentials, but data recovery becomes impossible when the user loses their password
Solution Approach 1:
The system segments the encryption key management into two independent parts: a user-controlled component (derived from password) and a service-provider-controlled component (recovery key). This segmentation allows the encryption key to be reconstructed through multiple paths - either through the user's password alone or through the service provider's recovery mechanism, thereby enabling data recovery without compromising the original security model.
Solution Approach 2:
The service provider acts as an intermediary by introducing a recovery key that mediates between the user's lost credentials and the encrypted data. When a user loses their password, the service provider can use their recovery key to generate a new encryption key, serving as a bridge that enables data recovery without requiring the original user credentials.
2Adaptability or versatility
If the encryption key is derived solely from user credentials stored on the encryption server, then user control over data is maintained, but the system cannot recover data when credentials are lost
Solution Approach 1:
The service provider performs preliminary action by pre-generating and securely storing a recovery key before the user ever encounters credential loss. This recovery key is created during account setup and stored in the service provider's secure key store, enabling future credential recovery without requiring complex real-time computations or additional user actions when loss occurs.
Solution Approach 2:
The recovery key mechanism serves multiple functions: it enables credential recovery, allows key rotation, and provides a backup authentication path. The same recovery key infrastructure supports various scenarios including lost passwords, account takeovers, and key updates, making the system versatile without requiring separate mechanisms for each scenario.
Data Source
Figure 1~3
AI summary
The present invention relates to a method to manage modification of encryption credentials (U/P) for an encryption server (ES), said encryption server (ES) being used to encrypt data (F1,F2) uploaded by an user (USR) after provision of his/her encryption credentials (ES) associated to an encryption account, said data thus encrypted ([F1]Ku,[F2]Ku) using a user encryption key (Ku) being stored in a cloud storage server (SS).