Encryption Key Generation Using Keystore Seed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data encryption methods, such as stand-alone tools like Winzip and secure PDF, are cumbersome and insecure, particularly in large-scale systems, due to the need for multiple passwords, weak encryption strength, and challenges in key management, leading to vulnerabilities in cloud storage and communication.
Innovation Solution
An encryption method that generates and manages encryption keys using a keystore seed with independent and identically distributed seed bits, allowing for the derivation of multiple encryption keys from a single seed, ensuring statistical independence and zero mutual information between keys and keying information, thus providing strong, secure encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If stand-alone tools like Winzip and secure PDF are used to encrypt multiple files, then file encryption can be achieved, but the process becomes tedious and user-unfriendly when the number of files increases
Solution Approach 1:
The system segments the encryption process by assigning a unique password to each file while using a single master password for key management. This allows individual file encryption without requiring the user to manually manage multiple complex passwords, resolving the contradiction between ease of operation and time consumption.
Solution Approach 2:
The encryption system provides universal functionality by enabling a single master password to manage encryption for multiple files through automated key generation. This multi-functional approach eliminates the need for separate password management for each file, making the process both easy and efficient.
2Reliability
If users choose strong random passwords for encryption, then encryption strength is improved, but users experience difficulty in coming up with and memorizing such passwords
Solution Approach 1:
The password system is segmented into a master password for key management and individual file passwords generated automatically. This allows users to remember only one simple master password while the system handles the complexity of strong random passwords for each file, resolving the contradiction between encryption strength and ease of operation.
Solution Approach 2:
The system introduces an intermediary key management mechanism that translates a simple user-chosen master password into strong encryption keys. This intermediary layer maintains strong encryption while shielding users from the complexity of managing strong random passwords.
3Reliability
If different passwords are used to encrypt different files, then file-specific security is improved, but users become confused about which password decrypts which file
Solution Approach 1:
The system extracts the complexity of password management from the user's responsibility by automatically generating and managing individual file passwords. The master password serves as a centralized control mechanism, allowing users to decrypt files without needing to remember or track multiple individual passwords.
Solution Approach 2:
The encryption system provides self-service by automatically generating, storing, and managing individual file passwords. This eliminates the need for users to manually track which password corresponds to which file, as the system handles this management automatically while maintaining file-specific security.
4Reliability
If passwords are forgotten or lost, then data protection is maintained, but it becomes difficult or impossible to recover the original plaintext files
Solution Approach 1:
The system performs preliminary action by establishing a secure backup mechanism for the master password and encryption keys before data loss can occur. This includes implementing secure storage solutions and recovery protocols that allow authorized recovery of encrypted files while maintaining data protection through controlled access.
Solution Approach 2:
The encryption system incorporates beforehand cushioning through redundant key storage and secure backup mechanisms. These measures are put in place before any password loss scenario occurs, providing a safety net that allows recovery of encrypted files while maintaining strong data protection through controlled access and verification.
5Reliability
If files are encrypted using stand-alone tools, then basic encryption is achieved, but sharing encrypted files among a group of people becomes tedious and requires side channels to exchange passwords
Solution Approach 1:
The encryption system provides universal functionality for file sharing by using a master password that can decrypt multiple encrypted files. This allows a group of people to share encrypted files securely by distributing only the master password through secure channels, eliminating the need to exchange multiple individual passwords through side channels.
Solution Approach 2:
The system merges the password management function by consolidating multiple file-specific passwords under a single master password. This combining approach simplifies the sharing process, as users only need to securely exchange one master password rather than multiple individual passwords, while maintaining the security of individual encrypted files.
Data Source
AI summary
The described embodiments relate to encryption methods and computer program products. An encryption application is used to determine a keystore seed with a seed bit set having seed bits in an ordered sequence. A plurality of key derivation sets are determined and a selected key derivation set is selected randomly. A key bit sequence is generated from the seed bit set using the selected key derivation set. An encryption key is generated using the key bit sequence, and corresponding keying information is determined from the selected key derivation set such that the latter is also derivable from the former. The keying information discloses zero information about the encryption key absent knowledge of the keystore seed. Plaintext data is encrypted using the encryption key to generate ciphertext data, and the keying information is stored with the ciphertext data. The encryption key may then be deleted.