Key Encryption Key Generation for Shared Data Store Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely distributing and updating encryption keys across multiple client entities in a shared data store, particularly in ensuring timely and secure access to encrypted data while maintaining key security.
Innovation Solution
The solution involves encrypting the data encryption key and storing it on a shared data store, with each client entity generating a key encryption key using a registration password and a random salt, allowing for local decryption and encryption of the data without exposing the encryption key, thus ensuring secure and simultaneous access across all entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are distributed across multiple client entities in a shared data store, then access to encrypted data is enabled, but key security is compromised
Solution Approach 1:
The encryption key is segmented into multiple key shares distributed across different client entities. No single client possesses the complete key, but collectively they can reconstruct it through a threshold mechanism. This enables data access while maintaining key security, as the segmented key cannot be compromised by any single entity.
Solution Approach 2:
A secure key management service acts as an intermediary that coordinates key reconstruction and management operations. This mediator orchestrates the collaborative decryption process without any single client entity having full access to the key material, thereby enabling data access while preserving key security through controlled intermediary management.
2Reliability
If encryption keys are updated, then security is improved, but all client entities must be updated which increases system complexity
Solution Approach 1:
Key updates are prepared and validated in advance by the key management service before being distributed to client entities. The new key material is pre-processed and ready for immediate deployment, eliminating the need for coordinated updates across all clients simultaneously and reducing system complexity.
Solution Approach 2:
Each client entity independently receives and processes key update instructions from the key management service without requiring coordination with other clients. The decentralized update mechanism allows each entity to self-update its key shares autonomously, simplifying the overall key update process while maintaining security.
3Ease of operation
If the encryption key is stored on the shared data store, then key access is simplified, but the data store must have encryption capabilities which increases device requirements
Solution Approach 1:
Instead of storing the actual encryption key on the data store, encrypted copies or representations of the key (key shares) are stored. These key shares appear as ordinary data to the data store system, allowing simplified access without requiring the data store to have special encryption capabilities, while maintaining security through the mathematical properties of the key sharing scheme.
Data Source
AI summary
An improved key encryption system is provided for encrypting sensitive data on a shared data store. Various embodiments contemplate a system where a plurality of data clients are connected to one or more shared data stores. A secure data storage facility is provided on one or more of the shared data stores by using an encryption scheme. Encryption keys for decrypting the sensitive data are stored on the same data store as sensitive data, which may be decrypted using the encryption keys. To provide another layer of security, the data encryption keys are themselves encrypted using a key encryption key (“KEK”), which is generated by, and stored in a local data store associated with the data clients.