Key Derivation for Secure Local Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Symmetric encryption faces challenges in storing encryption keys securely without exposing plaintext data remotely, leading to performance issues and increased security risks due to the need to send large data items for encryption and decryption.
Innovation Solution
A system and method using a key derivation function (KDF) where a first machine obtains an initialization vector and sends it to a second machine storing the encryption key, generating a derived key which is then sent back to the first machine for encryption or decryption, allowing secure and efficient encryption and decryption without altering the ciphertext format or size.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the encryption key is stored and used remotely in a HSM/vHSM, then security is improved by making it hard for attackers to breach the system, but the time required to encrypt large data items increases significantly
Solution Approach 1:
The encryption process is segmented into two parts: key derivation occurs remotely in the HSM/vHSM to maintain security, while the actual encryption of large data items occurs locally to improve performance. This segmentation allows the system to benefit from both secure key management and fast local computation.
Solution Approach 2:
The key derivation is performed in advance in the HSM/vHSM before the actual encryption operation. By pre-computing the derived key and storing it securely, the system avoids the need to perform key derivation during the encryption process, thus improving encryption speed while maintaining security.
2Reliability
If plaintext data is sent remotely to the HSM/vHSM for encryption, then the encryption operation can be performed securely, but additional security risks are introduced due to data exposure during transmission
Solution Approach 1:
The plaintext data is extracted from the remote communication process and kept entirely local. Only the derived key (not the plaintext) is used for encryption locally, eliminating the security risk of transmitting sensitive plaintext data over the network while still benefiting from remote key management.
Solution Approach 2:
The derived key acts as an intermediary that enables local encryption without requiring plaintext to be transmitted remotely. This intermediary mechanism allows the system to maintain security by keeping plaintext local while still utilizing the secure key management capabilities of the HSM/vHSM.
3Productivity
If envelope encryption is used to encrypt data locally with a DEK, then performance and security are improved, but the ciphertext size increases due to the need to store both the encrypted data and the encrypted DEK
Solution Approach 1:
The encrypted DEK (ciphertext wrapper) is extracted and eliminated from the output. Instead of returning both the encrypted data and the encrypted DEK as in traditional envelope encryption, this system only returns the encrypted data, reducing the overall ciphertext size while maintaining the security benefits of local encryption.
Solution Approach 2:
The system uses a simplified approach where the derived key is used directly for encryption without creating a separate encrypted key structure. This eliminates the need to store and manage additional ciphertext components, reducing the overall data size while maintaining encryption security.
Data Source
AI summary
A computerized system and method for symmetric encryption and decryption using two machines, the method including obtaining a message and an initialization vector on a first machine, sending the initialization vector to a second machine, where said second machine stores an encryption key for a Key Derivation Function (KDF), generating a derived key on the second machine by applying the KDF receiving as input both the encryption key and the initialization vector, sending the derived key from the second machine to the first machine, and encrypting the message using the derived key on the first machine.