Key Protector Using Intermediate Key for Storage Volume Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing portable storage devices face security challenges due to user frustration with additional steps required for data protection, leading to inadequate security measures being implemented.
Innovation Solution
A key protector system is created using a public/private key pair, where an intermediate key is generated and used to encrypt a volume master key, allowing encrypted storage volumes to be accessed by obtaining the private key and decrypting the volume master key, which in turn decrypts the storage volume.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms are implemented to protect data on portable storage devices, then data security is improved, but user operation complexity increases requiring additional steps for protection
Solution Approach 1:
The security system is segmented into multiple key layers: a volume master key for encrypting data, volume encryption keys for specific encryption operations, and an intermediate key protected by public/private key pairs. This segmentation allows different security functions to be performed by different key components, improving both security and operational simplicity.
Solution Approach 2:
The intermediate key is pre-protected using the entity's public key before being stored on the device. This preliminary cryptographic protection ensures that when the device is accessed, the intermediate key is already secured and ready for use, eliminating the need for additional protection steps during normal operation.
2Reliability
If multiple key layers are used to encrypt the storage volume, then security is enhanced, but the key management system becomes more complex
Solution Approach 1:
The intermediate key serves as a cryptographic intermediary between the volume master key and the entity's public/private key pair. It simplifies key management by providing a single protected key that can be used to derive the volume master key, rather than requiring direct management of multiple complex key relationships.
Solution Approach 2:
The system adds a temporal dimension to key protection by separating key protection (done in advance using public key cryptography) from key usage (done during normal operation). This dimensional separation allows complex security to be implemented without adding complexity to the user-facing key management interface.
Data Source
AI summary
A key protector for a storage volume is created by generating an intermediate key and protecting, based at least in part on a public/private key pair, the intermediate key. A volume master key for encrypting and decrypting one or more volume encryption keys that are used to encrypt the storage volume can be encrypted in different manners, including being encrypted based at least in part on the intermediate key. A key protector for the storage volume is stored that includes both the encrypted volume master key and information indicating how to obtain the intermediate key. Subsequently, the key protector can be accessed and, based at least in part on a private key of the entity associated with the key protector, the intermediate key can be decrypted. The intermediate key can then be used to decrypt the volume master key.