Key Migration via Segmented Derivation and Multi-Entity Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key migration methods, such as PKCS #12, are vulnerable to brute force attacks and lack secure access control semantics, especially when used in cloud storage, as they rely on a single entity maintaining all necessary inputs for key derivation, making them susceptible to dictionary attacks and other security breaches.
Innovation Solution
A self-directed key migration method that utilizes a trusted execution environment (TEE) and separates key derivation components among multiple entities, requiring all entities to contribute their inputs correctly for successful migration, incorporating authentication, authorization, and contextual policies to enhance security, and employs random number, authentication, and context policy servers to harden the endpoints against attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single entity maintains all inputs for key derivation (PKCS #12 standard), then key migration is simple and straightforward, but the system becomes vulnerable to brute force and dictionary attacks
Solution Approach 1:
The patent divides the key derivation inputs into multiple separate components stored in different locations (source device, target device, and cloud storage). Each component is essential for key derivation, so compromising one location alone is insufficient. This segmentation resolves the contradiction by making the system more secure without significantly complicating the migration process, as the standardized interface maintains ease of use.
Solution Approach 2:
The patent introduces a cloud storage service as an intermediary that stores encrypted key migration blocks. The cloud storage acts as a mediator that requires collaboration between multiple entities (source device, target device, and cloud storage) to successfully derive the key, thereby enhancing security while maintaining operational simplicity through standardized protocols.
2Ease of operation
If key migration blocks are stored in cloud storage, then accessibility and convenience are improved, but security is compromised due to lack of access control semantics
Solution Approach 1:
The patent segments the key derivation process so that the cloud storage only holds encrypted key migration blocks without possessing all necessary components for decryption. The actual key derivation requires additional inputs from both source and target devices, preventing unauthorized access even if cloud storage is compromised.
Solution Approach 2:
The patent applies different security characteristics to different components: the cloud storage provides convenient accessibility for storing encrypted blocks, while the local devices maintain critical security functions by holding unique authentication factors required for key derivation. This local quality differentiation resolves the contradiction between accessibility and security.
3Reliability
If multiple entities are required for key derivation, then security against attacks is enhanced, but system complexity increases
Solution Approach 1:
The patent employs universal interfaces and standardized protocols (such as PKCS #12) that allow multiple entities to collaborate through well-defined communication channels. This multi-functionality enables the system to work with various cloud storage services and devices without increasing complexity, as the standardized interface handles the coordination between multiple entities.
Solution Approach 2:
The patent implements feedback mechanisms where the system verifies that all required components are present and valid before completing key derivation. This feedback loop automates the coordination between multiple entities, reducing manual intervention and managing complexity through systematic verification processes.
Data Source
AI summary
A destination data processing system (DPS) receives a key migration block from a source DPS. The key migration block includes an encrypted version of a primary key. The destination DPS receives user input that identifies (a) an authentication policy and (b) a context policy. The destination DPS collects authentication data from the user, based on the identified authentication policy. The destination DPS collects context data, based on the identified context policy. The destination DPS uses the authentication data and the context data to decrypt the key migration block. The authentication data may comprise multiple types of authentication data, possibly including biometric data. The user may also input an index, and the destination DPS may use the index to retrieve a number from a random number server. The destination DPS may use that number to decrypt the key migration block. Other embodiments are described and claimed.