Fault-Tolerant Digital Asset Access Without Storing Sensitive Security Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard algorithms for encrypting digital assets are vulnerable to hacking and single-point failures, as keys are typically stored for decryption, making them susceptible to corruption or loss.
Innovation Solution
A system that generates cryptographic keys using standard techniques and creates polynomials from key bits, where coefficients are derived from sensitive security data sourced in real-time, allowing for redundant encryption and decryption without storing sensitive security data, using polynomial interpolation to recreate keys from (x, y) pairs generated from user context functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored for decryption, then access to digital assets can be recovered, but security is compromised due to vulnerability to hacking and single-point failure
Solution Approach 1:
The cryptographic key is segmented into multiple shares using secret sharing schemes (e.g., Shamir's Secret Sharing). Each share is distributed to different storage locations or devices, so that no single point contains the complete key. This eliminates the single-point failure risk while maintaining the ability to reconstruct the key through polynomial interpolation when sufficient shares are available.
Solution Approach 2:
The sensitive cryptographic key material is extracted from the storage system entirely. Instead of storing keys, the system stores only encrypted data and metadata necessary for key reconstruction. The actual key exists only temporarily in memory during encryption/decryption operations, eliminating the attack surface for key theft while preserving access capability through mathematical reconstruction.
2Object-affected harmful factors
If cryptographic keys are not stored, then security against hacking is improved, but access is lost if keys are corrupted or deleted
Solution Approach 1:
The system performs preliminary actions by pre-distributing key shares to multiple secure locations or devices before any potential key loss scenario occurs. These shares are prepared in advance using polynomial evaluation, and the reconstruction mechanism is pre-configured, ensuring that key recovery can proceed immediately without requiring the original key to be stored or accessible.
Solution Approach 2:
The system provides beforehand cushioning by creating redundant key shares that act as a safety buffer against key loss. The mathematical structure of secret sharing ensures that as long as a threshold number of shares remain intact, the original key can be recovered, providing a cushion against corruption or deletion of individual shares while maintaining security.
3Reliability
If polynomial coefficients are derived from real-time sensitive security data, then key recreation becomes fault-tolerant, but system complexity increases
Solution Approach 1:
The polynomial-based secret sharing mechanism serves multiple functions: it provides key generation, key distribution, fault tolerance, and secure reconstruction all through a single mathematical framework. This universal approach eliminates the need for separate mechanisms for each function, reducing overall system complexity despite the sophisticated mathematics involved.
Solution Approach 2:
The system uses parameter changes in the polynomial coefficients, which are derived from real-time sensitive security data, to create dynamically varying key shares. This allows the same polynomial structure to generate different secure configurations based on current security parameters, providing fault tolerance through mathematical transformation rather than complex hardware or procedural changes.
Data Source
AI summary
An encryption key is created, and sensitive security data is sourced from it and from live data collected in real-time from a user context by a group functions. Subsequently, indicators to functions are stored and the encryption key with the sensitive security data is deleted. Redundancy is provided so that the decryption key can be created from different combinations of functions. A decryption key is later generated with sensitive security data using one or more stored indicators of the one or more functions to obtain an instance of live data in real-time from a current user context. Failing to generate the correct decryption key will result in repeating the creation of the decryption key with different groups of functions until access is granted or combinations of redundant stored functions are exhausted.