Key Segmentation for Secure Cryptographic Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems are user-dependent and vulnerable to security breaches, as users often store private keys on accessible devices and choose weak file names, leading to key compromise and inadequate security, especially in mobile environments.
Innovation Solution
A cryptographic system with a trust engine that stores cryptographic keys and user authentication data on a secure server, allowing users to access cryptographic functions without releasing the actual keys, using a data splitting process to create undecipherable portions stored in geographically remote locations, ensuring security and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store private keys on accessible devices for easy access, then ease of operation is improved, but security is worsened due to vulnerability to brute-force attacks and key compromise
Solution Approach 1:
The private key is divided into multiple shares that are distributed across different locations (mobile device, remote server, cloud storage). No single location contains the complete key, so compromising one location does not compromise the entire key. This segmentation maintains accessibility through multiple devices while improving security by distributing risk.
Solution Approach 2:
A remote server acts as an intermediary to store and manage portions of the private key. The server receives authentication credentials from the mobile device, verifies them against stored shares, and facilitates key reconstruction without storing the complete key itself. This intermediary approach enables secure key management without requiring the mobile device to store the full key.
2Reliability
If cryptographic systems provide strong security through key encryption, then reliability is improved, but device complexity increases due to multiple keys and authentication requirements
Solution Approach 1:
The private key is segmented into multiple shares that can be distributed across different devices and locations. Each share is encrypted and stored separately, allowing the system to maintain strong security through encryption while reducing complexity by breaking down the key management task into smaller, manageable pieces that can be handled by multiple devices.
Solution Approach 2:
The system uses a universal authentication mechanism that works across multiple devices and locations. The same authentication credentials and share verification process can be applied whether the user is accessing the system from a mobile device, remote server, or cloud storage, simplifying the user experience while maintaining security.
3Ease of operation
If the system stores complete private keys on mobile devices for authentication, then ease of operation is improved, but security is worsened due to key migration and exposure to multiple systems
Solution Approach 1:
The private key is segmented into multiple shares that are distributed across different locations including mobile devices, remote servers, and cloud storage. This segmentation ensures that no single device contains the complete key, reducing the risk of key exposure while maintaining authentication convenience through distributed access.
Solution Approach 2:
The complete private key is extracted from any single location and distributed across multiple systems. The mobile device stores only a portion of the key and uses it in conjunction with authentication credentials and other shares to reconstruct the full key when needed, preventing key migration and exposure to multiple systems.
Data Source
AI summary
A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths. A keyed information dispersal algorithm (keyed IDA) may also be used. The key for the keyed IDA may additionally be protected by an external workgroup key, resulting in a multi-factor secret sharing scheme.