Cryptographic Key Replacement via Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public-key cryptography systems face challenges in replacing cryptographic keys when a device is stolen, lost, or damaged, as the existing method requires both old and new token pairs to be present simultaneously, which is not feasible in cases of theft or damage.
Innovation Solution
A method involving pseudorandom key pairs, where a first key pair is replaced by a second key pair through a secret sharing scheme, with shares distributed among shareholders for safekeeping, allowing reconstruction and authentication without requiring both tokens at once, and further key pairs can be generated and replaced similarly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the existing key replacement method requiring both old and new tokens simultaneously is used, then key replacement can be authenticated, but key replacement becomes impossible when device is stolen or damaged
Solution Approach 1:
The patent segments the cryptographic key replacement process into two distinct phases: (1) pre-generation and distribution of replacement key shares to multiple shareholders, and (2) reconstruction of the replacement key using secret sharing schemes. This segmentation eliminates the need for simultaneous presence of old and new tokens, as the replacement key can be reconstructed from distributed shares alone.
Solution Approach 2:
The patent performs preliminary actions by generating and distributing replacement key shares to multiple shareholders before the old device is lost or stolen. This advance preparation ensures that when key replacement is needed, the replacement key can be reconstructed without requiring the old device, thus resolving the contradiction between reliability and operability.
2Ease of operation
If cryptographic keys are stored in a single device, then key access is simple, but security is compromised when device is stolen or lost
Solution Approach 1:
The patent divides the cryptographic key into multiple shares using secret sharing schemes and distributes these shares to different shareholders. This segmentation ensures that no single shareholder possesses the complete key, thereby mitigating the risk of theft or loss while maintaining the ability to reconstruct the key when needed.
Solution Approach 2:
The patent introduces multiple shareholders as intermediaries who hold portions of the cryptographic key. These shareholders act as mediators that collectively enable key reconstruction without any single party having full access, thus balancing security requirements with operational needs.
3Reliability
If key shares are distributed among multiple shareholders, then security is improved, but key reconstruction complexity increases
Solution Approach 1:
The patent enables the key reconstruction process to be self-service by implementing standardized secret sharing schemes that can be executed automatically by the system itself. This reduces the need for complex manual intervention or external assistance during key reconstruction, thereby mitigating the complexity increase while maintaining enhanced security.
Data Source
AI summary
A feature is provided that facilitates securely creating and/or replacing cryptographic keys. A first key pair is created comprising first private key and first public key. A second (spare) key pair is created comprising second private key and second public key. The second key pair is associated with the first private key. The second key pair is divided into shares and distributed to at least two shareholders. When the first key pair is to be replace, the second key pair is recreated and authenticated with at least a portion of the distributed shares. A trust level is associated with the second key pair corresponding to a trust level of the first key pair. The first key pair may be invalidated upon authentication of the second key pair. Further configurations provide for the creation of additional spare key pairs.