Cryptographic Key Management via Intermediary Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic key management systems in networked environments lack effective lifecycle management, leading to unmanaged keys that are susceptible to security attacks, with no mechanism for re-keying, replacing, or revoking keys, especially in consumer applications like email and file storage.
Innovation Solution
A cryptographic key management system that uses a proprietary server, non-proprietary server, and desktop components linked through a service protocol to manage keys and policies, supporting access control, key access consolidation, and fine-grained access control, with features like user and device enrollment, authentication methods, and key rotation, utilizing Managed Encryption Keys (MEKs) and Managed Asymmetric Keys (MAKs) with metadata and notification groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cryptographic keys are managed in a decentralized manner across multiple systems, then system autonomy and flexibility are improved, but security vulnerability and key management complexity increase
Solution Approach 1:
The patent introduces a key management server as an intermediary component that mediates between clients and the key lifecycle. This server provides centralized key generation, distribution, rotation, and revocation capabilities while allowing clients to maintain operational autonomy. The intermediary manages the cryptographic keys securely and provides them to clients only when needed, thus maintaining system flexibility while improving security through centralized control.
2Speed
If cryptographic keys are stored locally on each system, then access speed and system independence are improved, but key revocation and re-keying capabilities deteriorate
Solution Approach 1:
The patent segments the key management functionality into two parts: long-term key material is stored securely in a key management server, while short-term session keys are cached locally on clients for fast access. This segmentation allows clients to use cached session keys for rapid cryptographic operations without repeatedly accessing the server, maintaining access speed. Simultaneously, the server retains control over the master keys, enabling centralized revocation and re-keying when security requirements change.
3Reliability
If key management is centralized in a single system, then security control and key lifecycle management are improved, but system complexity and single point of failure risks increase
Solution Approach 1:
The patent introduces a hierarchical dimension to the key management architecture, with multiple levels of key hierarchy (master keys, session keys, data encryption keys) and multiple dimensions of control (policy-based access control, time-based key rotation, role-based permissions). This multi-dimensional approach allows centralized security control through the key management server while distributing the actual cryptographic operations across multiple clients and services, reducing the single point of failure risk and managing complexity through structured organization.
4Reliability
If cryptographic operations are performed on the server, then key security is improved, but network dependency and processing latency increase
Solution Approach 1:
The patent implements preliminary action by pre-generating and caching cryptographic session keys on client systems before they are actually needed for data encryption or decryption operations. The key management server performs the computationally intensive key generation and security-critical operations in advance, then distributes the prepared session keys to clients. This allows clients to perform cryptographic operations locally with minimal network dependency and low latency, while the server maintains security control over the key lifecycle.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
A cryptographic key management system includes executable instructions to control access to keys based on permissions for users and groups. Executable instructions support cryptographic operations on the keys through a network application program interface. The cryptographic operations are controlled by the permissions. The cryptographic operations are distributed between the servers and the clients in accordance with criteria specifying optimal execution of cryptographic operations between the servers and the clients.