Distributed Data Storage Using HSM Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IT security measures for data storage, such as encryption and access restrictions, are inadequate as they can be compromised by physical theft or remote access, posing a significant risk for portable devices and network-accessible IT systems.
Innovation Solution
A distributed secure data management system using secure multi-party computation to decompose data into parts stored across multiple IT devices, including HSMs, SAMs, and SEs, ensuring that no single device holds the complete data, thereby preventing unauthorized extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored using conventional encryption and access restrictions, then data security is provided to some extent, but the security can be compromised by physical theft or remote access attacks
Solution Approach 1:
The patent divides the complete data into multiple parts and distributes them across multiple secure storage elements. No single element contains the complete data, so physical theft of one device does not compromise the entire data set. The data remains secure as long as the threshold number of parts are kept separate.
Solution Approach 2:
The patent implements a hierarchical structure where data is first decomposed into parts, then each part is further encrypted using multiple layers of encryption keys. These nested encryption layers are stored in different secure elements, creating a nested protection structure that must be unwound in sequence to access the data.
2Ease of operation
If complete data is stored on a single IT device, then data access is simple and fast, but the device becomes a high-value target for theft and intrusion
Solution Approach 1:
The patent segments the data into multiple parts and distributes them across multiple devices. While this increases system complexity, it dramatically reduces the attractiveness of each individual device as a theft target, since none contains the complete usable data.
Solution Approach 2:
The patent uses secure multi-party computation to enable data operations by combining results from multiple distributed parts without reconstructing the complete data in any single location. This allows secure data processing across distributed devices while maintaining security.
3Reliability
If data is decomposed and distributed across multiple devices using secure multi-party computation, then complete data extraction is prevented, but system complexity increases
Solution Approach 1:
The patent divides data into parts and distributes them across multiple HSMs or secure elements. This segmentation prevents any single device from containing complete data, thereby preventing extraction while the modular architecture manages complexity through clear division of responsibilities.
Solution Approach 2:
The patent creates a universal distributed data storage architecture that can handle various data types and security requirements through a common framework of secure multi-party computation, reducing complexity by providing a unified approach rather than separate solutions for different scenarios.
4Reliability
If multiple secure storage elements are used for distributed data storage, then data security and redundancy are improved, but the cost and device complexity increase
Solution Approach 1:
The patent segments data into parts distributed across multiple secure elements, providing both security and redundancy. If one element fails or is compromised, the data remains secure and recoverable from other elements, while the segmentation ensures no single point of failure exists.
Solution Approach 2:
The patent allows flexible configuration of the number of secure storage elements and the threshold required for data reconstruction. This parameter-based approach enables optimization of the balance between security, redundancy, and system complexity based on specific organizational needs.
Data Source
Figure 1
Figure 2a~2b
Figure 3a~3b
AI summary
The present invention relates to a method for secure data management. The essence of the invention is to convert data, such as a file to be stored, a password used for authentication, a key of an AES cryptographic method, into a primary number sequence, decomposing the primary number sequence into n primary parts, transmitting the n primary parts to an IT device suitable for data storage, preferably to an IT device comprising an HSM, SAM or SE device, and storing the transmitted primary parts distributed in the respective IT devices as part of secure data management of even different entities. In the case of authentication, the decomposed password is compared in a distributed manner with another decomposed password. In the case of AES encryption, the cryptography key stored in a distributed manner is used to encrypt the data to be encrypted, which may also be distributed.