Encryption Key Management for Single-Sign-On Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based data storage systems face vulnerabilities due to potential unauthorized access to user accounts, weak encryption, and reliance on system administrators for data security, which can compromise sensitive data even with best practices in place.
Innovation Solution
A computer-implemented method and system for managing encryption keys that encrypts master keys using a session key, stores them in a client key store, and allows access to encrypted data across multiple cloud services without reauthentication, ensuring that cloud services never access keys needed to decrypt user data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cloud services store encryption keys locally for fast decryption, then decryption speed improves, but security deteriorates because cloud service administrators can access unencrypted keys
Solution Approach 1:
The encryption key management is segmented into multiple components: master keys stored securely on user devices, service-specific keys stored in cloud key stores, and session keys generated temporarily. This segmentation ensures that no single entity (including cloud administrators) can access all keys needed to decrypt user data, while still enabling fast decryption through local session key usage.
Solution Approach 2:
A key management service acts as an intermediary between users and cloud services. This service facilitates key exchange and session key generation without requiring cloud service administrators to access master keys, thus maintaining both security and operational efficiency.
2Reliability
If cloud services implement strong encryption for data at rest, then data security improves, but access convenience deteriorates because users must authenticate repeatedly
Solution Approach 1:
Master keys are derived from user authentication credentials in advance and stored securely on user devices. Service keys are pre-configured in cloud key stores. When users authenticate, session keys are generated and cached temporarily, enabling rapid access to encrypted data without repeated full authentication while maintaining strong encryption security.
3Device complexity
If cloud services maintain confidential security practices, then system complexity is reduced, but security verification deteriorates because users cannot verify proper security implementation
Solution Approach 1:
The system provides feedback mechanisms that allow users to verify security implementation. Users can confirm that their master keys are properly protected, that service keys are securely stored in cloud key stores, and that session keys are appropriately managed. This transparency maintains security while enabling verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed computer-implemented method for managing encryption keys for single-sign-on applications may include (1) receiving, from an identity service, notification of a request to access encrypted data on a cloud service, the notification including a session key for encrypting and decrypting a master key for decrypting cloud service keys, (2) deriving the master key, (3) decrypting, using the master key, a cloud service key for decrypting data on the cloud service, (4) storing the master key, encrypted using the session key, (5) receiving an additional notification of an additional request to access encrypted data on an additional cloud service, the notification including the session key, (6) without again obtaining the authentication element from the user, decrypting the master key, and (7) decrypting, using the master key, an additional cloud service key for decrypting data on the additional cloud service. Various other methods, systems, and computer-readable media are also disclosed.