Key Share Distribution for Low-Latency Multi-Party Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge of securely managing cryptographic keys in cloud computing environments, where the risk of key interception and increased latency in cryptographic operations poses security and efficiency concerns, especially when relying on third-party cloud providers.
Innovation Solution
Implementing a three-party Yao protocol using garbled circuits to distribute cryptographic key shares among multiple computer nodes, ensuring that no single node possesses the entire key, and performing cryptographic operations without exposing the key to the cloud environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cryptographic keys are retrieved from hardware security modules to perform cryptographic operations, then cryptographic operations can be executed, but the risk of key theft or leakage increases
Solution Approach 1:
The cryptographic key is divided into multiple key shares that are distributed to different computer nodes. No single node possesses the complete key, thereby preventing key leakage while enabling cryptographic operations through collaborative computation using garbled circuits.
Solution Approach 2:
Garbled circuits serve as an intermediary mechanism that enables cryptographic operations without requiring direct key exposure. The circuit evaluation process allows computation on encrypted data, acting as a mediator between the need for operations and the need for key protection.
2Reliability
If cryptographic keys remain in hardware security modules and are accessed each time a cryptographic operation is needed, then key security is maintained, but latency and communication overhead increase
Solution Approach 1:
Key shares are generated and distributed to computer nodes in advance, before cryptographic operations are needed. This preliminary distribution eliminates repeated access to hardware security modules during operations, reducing latency while maintaining security through the distributed share structure.
3Adaptability or versatility
If cryptographic keys are transmitted to cloud computing environments, then cryptographic operations can be performed on cloud infrastructure, but the risk of key interception by third parties increases
Solution Approach 1:
The key is segmented into multiple shares distributed to different nodes, ensuring that even if cloud infrastructure is compromised, the complete key cannot be reconstructed from individual shares alone, thereby mitigating interception risks while enabling cloud-based operations.
Solution Approach 2:
Different key shares are assigned to different computer nodes with specific roles in the cryptographic process. Each node operates with localized knowledge of only its own share, preventing any single point of failure or interception while maintaining overall system functionality in the cloud environment.
Data Source
AI summary
Methods and systems for managing cryptographic keys in on-premises and cloud computing environments and performing multi-party cryptography are disclosed. A cryptographic key can be retrieved from a hardware security module by a key management computer. The key management computer can generate key shares from the cryptographic key, and securely distribute the key shares to computer nodes or key share databases. The computer nodes can use the key shares in order to perform secure multi-party cryptography.