Hybrid Cryptography Key Management via User Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptography methods for secure data storage either rely on a single key for encryption and decryption, which is insecure if compromised, or use complex key pairs that are difficult to manage effectively.
Innovation Solution
Implementing hybrid symmetric/asymmetric cryptography, where user authentication factors are used to generate an asymmetric decryption key, which is then converted into an asymmetric encryption key to encrypt a symmetric key for data encryption and decryption, ensuring secure storage without storing the decryption key or symmetric key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If symmetric cryptography is used with a single key for encryption and decryption, then the system is simple to implement, but security is compromised if the key is leaked
Solution Approach 1:
The patent divides the key management into separate components: a master key stored securely in the device, and derived session keys generated from user authentication factors. This segmentation allows the master key to remain secure while enabling flexible, secure data encryption without exposing the master key.
Solution Approach 2:
The patent introduces user authentication factors (such as biometric data or PINs) as intermediaries between the master key and the actual data encryption. These factors serve as a mediator that must be provided by the user to derive the session key, adding an extra layer of security without complicating the overall key management architecture.
2Reliability
If asymmetric cryptography with key pairs is used, then security is improved, but key management becomes complex and difficult to manage
Solution Approach 1:
The patent extracts the complex key pair generation and management responsibilities from the user-facing interface. The asymmetric key pairs are generated and managed automatically by the system in the background, while users only interact with simple authentication factors, effectively removing the complexity from the user experience.
Solution Approach 2:
The system performs self-service key management by automatically generating asymmetric key pairs, deriving session keys from user authentication factors, and handling key rotation without user intervention. This eliminates the need for users to manually manage complex key pairs while maintaining high security.
3Speed
If decryption keys are stored for quick access, then decryption speed is improved, but security is compromised since the decryption key can be exposed
Solution Approach 1:
The patent performs preliminary key derivation by pre-computing and storing encrypted versions of user authentication factors along with their corresponding session keys. When decryption is needed, the system retrieves the encrypted authentication factor, verifies it against the current authentication, and uses the pre-derived session key for quick decryption, balancing speed and security.
Solution Approach 2:
Instead of storing the actual decryption key, the patent stores encrypted copies of authentication factors and derived session keys. The actual decryption key material is generated on-demand from the authentication factor and master key, creating a copy that is used only for the current decryption operation and then discarded, eliminating permanent exposure risks.
Data Source
AI summary
A device uses a user authentication factor to generate an asymmetric decryption key for use in cryptography. An asymmetric encryption key is generated from the asymmetric decryption key using a one-way function, and the asymmetric encryption key is used to encrypt a symmetric key.