Cryptographic Key Protection via Password Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting decryption keys in cryptographic systems often require third-party involvement for password changes or recovery, compromising user data confidentiality.
Innovation Solution
A method that generates a second cryptographic key from a user's password, encrypts the first cryptographic key with this second key, and stores ciphertexts of the password associated with personal questions, allowing the user to regenerate the decryption key without storing sensitive information on the management device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a decryption key is protected using a login and password with key derivation, then the user can easily memorize access credentials, but the user cannot change the password or recover from password loss without third-party involvement
Solution Approach 1:
The system segments the password protection mechanism into multiple independent components: the decryption key is separated from the password, and the password itself is segmented into encrypted segments stored on the server. This allows the user to change one password segment without affecting the decryption key, resolving the contradiction between ease of operation and adaptability.
Solution Approach 2:
The patent introduces an intermediary encrypted password segment stored on the server that acts as a bridge between the user's current password and the decryption key. This intermediary allows password changes and recovery without requiring third-party involvement, as the server can regenerate the password segment using the user's new password while maintaining the ability to decrypt the original key.
2Reliability
If the decryption key is encrypted and stored on a remote server, then access control is improved, but complete confidentiality of user data is compromised due to third-party access
Solution Approach 1:
The patent extracts the sensitive decryption key from the server environment and keeps it locally on the user's device. Only an encrypted password segment is stored on the server, which is mathematically useless without the user's password. This extraction eliminates the confidentiality risk while maintaining reliable access control through the client-side key.
Solution Approach 2:
The system changes the cryptographic parameters by using the user's password to derive a key that encrypts the password segment on the server, rather than storing the decryption key itself on the server. This parameter change ensures that even if the server is compromised, the decryption key remains confidential as it never leaves the user's device.
3Reliability
If a second cryptographic key is used to protect the decryption key, then security is improved, but password recovery requires third-party involvement or encryption with data known to a third party
Solution Approach 1:
The patent implements self-service by enabling the user to independently change and recover passwords using the encrypted password segment stored on the server. The user's password and the encrypted segment work together as a self-contained system that eliminates the need for third-party intervention in password management operations.
Solution Approach 2:
The system performs preliminary action by pre-encrypting the password segment with the user's password and storing it on the server before any password change or recovery operation is needed. This preliminary encryption enables rapid password changes and recovery without requiring complex third-party verification processes.
Data Source
AI summary
A technique for protecting a cryptographic key. A user has an identifier and an associated password. The first cryptographic key is designed to decrypt a piece of encrypted data. The user device generates a second cryptographic key by applying a key derivation algorithm to at least the password, then encrypts the first cryptographic key by applying an encryption algorithm parameterized by the second cryptographic key. The user device then provides the encryption of the first cryptographic key to a management device for storage. A response associated with a question is obtained from the user. The user device calculates a result of an application of a function to at least one response associated with a question, then provides a value dependent on the result to a management device for storage. The value then enables the user device to determine the password when it has the response to the corresponding question.