Key Management Server Coordination for Split Encryption Key Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems using two levels of encryption are vulnerable if both encryption keys are compromised, leading to a loss of data security and inefficient resource allocation for identifying and notifying affected users.
Innovation Solution
Implement a key management server that manages two encryption keys separately, ensuring they are not simultaneously stored or accessible by a single server, allowing only one key to be used at a time to maintain data security even if the other is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two levels of encryption are used to protect data, then data security is improved, but the system becomes vulnerable if both encryption keys are compromised
Solution Approach 1:
The patent divides the key management system into separate components: a key management server that stores encrypted keys and service servers that access them. The first encryption key is stored encrypted by the key management server, and the second encryption key is stored in plaintext at the service server. This segmentation ensures that even if both keys are compromised, the data remains protected because the keys are stored in different locations with different security levels.
Solution Approach 2:
The key management server acts as an intermediary between the service server and the encryption keys. It manages the first encryption key by storing it in encrypted form, while allowing the service server to access the second encryption key in plaintext. This intermediary role enables controlled key distribution and prevents direct storage of both keys at the same location, reducing the impact of key compromise.
2Reliability
If encryption keys are stored at multiple locations to improve security, then data protection is enhanced, but resource allocation for breach response becomes inefficient
Solution Approach 1:
The patent segments key storage across different locations (key management server and service server) but with different encryption levels. This allows the system to maintain security through distributed storage while enabling efficient breach response by knowing exactly where keys are stored and how they are protected, allowing targeted response efforts.
Solution Approach 2:
The patent changes the storage parameter of the first encryption key from plaintext to encrypted form at the key management server. This parameter change maintains security benefits of multi-location storage while improving breach response efficiency by reducing the attack surface and enabling more targeted security monitoring and response.
Data Source
AI summary
Methods and systems are disclosed for managing access to encrypted data and encryption keys. The system stores, by a key management server, a first encryption key associated with a first service and a second encryption key associated with a second service. The system prevents, by the key management server, the second service from accessing the second encryption key while the first service is performing a first function using the first encryption key and determines that a first threshold period of time associated with the first function has elapsed. The system, in response to determining that the first threshold period of time associated with the first function has elapsed, prevents, by the key management server, the first service from accessing the first encryption key while the second service is performing a second function using the second encryption key.