Enterprise Key Management via Identity-Linked Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management tools do not adequately address the secure management of private and public keys, particularly in enterprise settings, where private keys should remain confidential and not be shared, and their misuse poses a significant security risk, with existing solutions failing to ensure seamless key expiration, accountability, and compliance with password policies.
Innovation Solution
A method and system that form a unique key pair for each user, with the private key encrypted using an enterprise password and device identification, stored on the user's device, and the public key stored on enterprise servers, ensuring secure access and automatic key pair regeneration upon changes in user status or device ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored on user devices for secure access, then authentication security is improved, but the risk of key misappropriation and loss increases
Solution Approach 1:
The patent introduces a key management service as an intermediary between users and their private keys. This service generates, stores, and manages key pairs on behalf of users, eliminating the need for users to directly handle private keys. The service acts as a trusted mediator that can revoke, rotate, and manage keys centrally while maintaining secure authentication, thus reducing misappropriation risk while preserving security.
Solution Approach 2:
The key management service enables automated key generation, rotation, and revocation without manual user intervention. Keys are automatically generated when users join the enterprise and automatically revoked when they leave or change roles. This self-service automation eliminates human error in key management while maintaining security controls.
2Adaptability or versatility
If manual key management processes are used, then flexibility in key handling is improved, but the complexity of tracking and managing millions of key pairs increases
Solution Approach 1:
The key management service provides a universal platform that handles multiple key management functions through a single system: key generation, distribution, storage, rotation, revocation, and auditing. This multi-functional approach consolidates what would otherwise require multiple separate manual processes, reducing overall system complexity while maintaining flexibility through programmable interfaces.
Solution Approach 2:
The system implements automated feedback loops where key usage is monitored, and key status is automatically updated based on user status changes. When users leave the enterprise or change roles, the system automatically detects these changes and revokes appropriate keys. This automated feedback mechanism eliminates manual tracking complexity while maintaining adaptive key management.
3Reliability
If private keys are encrypted with user passphrases, then key security is improved, but the inability to automatically expire keys when passwords change worsens compliance with password policies
Solution Approach 1:
The key management service acts as an intermediary between enterprise password policies and cryptographic key management. It implements a separate key encryption mechanism that is independent of user passphrases, allowing the enterprise to enforce password policies without directly compromising key security. The service can rotate keys based on policy requirements while maintaining strong cryptographic protection through its own key management infrastructure.
Solution Approach 2:
The system implements dynamic key management where key encryption keys and validity periods can be automatically adjusted based on enterprise policies, user roles, and time-based factors. Keys can be automatically rotated or revoked based on policy changes without requiring manual re-encryption with new user passphrases, enabling both strong security and policy compliance.
4Reliability
If new key pairs are regenerated when keys are lost or stolen, then security is improved, but the time and effort required for key management increases
Solution Approach 1:
The key management service performs preliminary actions by pre-generating and storing backup key pairs securely before they are needed. When keys are lost or stolen, the system can immediately provide pre-generated replacement keys without requiring time-consuming regeneration processes. This preliminary preparation eliminates delays in security response while maintaining security through secure key generation and distribution protocols.
Solution Approach 2:
The system implements automated key regeneration and distribution that occurs without manual user intervention. When key loss or compromise is detected, the system automatically generates new key pairs, distributes them to authorized users, and updates associated public keys on servers. This automation eliminates the time-consuming manual processes of key regeneration while maintaining security through controlled automated procedures.
Data Source
AI summary
A method forms a key pair for a user. The key pair has a public key and a private key that is unique to the user and that is encrypted using a passphrase formed from an enterprise password of the user and an identification that uniquely identifies in the enterprise a device by which the user gains access. The method stores the private key in the user device and stores the public key in an enterprise server that is accessed by the user. The method provides the private key from the user device to a client, such as a SSH client, in conjunction with the password and the identification, decrypts the private key to obtain the decrypted password and the identification, and allows the user to access the enterprise server only if the decrypted password and the identification match the password and the identification provided with the private key.