Lockbox Credential Store Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing credential store security systems require user interaction to update passwords, which is unacceptable in certain environments, as they cannot automatically decrypt the credential store with a new password if the system administrator changes the 'master' password.
Innovation Solution
A lockbox system that includes a local and global lockbox with a list of encryption keys, allowing automatic decryption and re-encryption of the credential store using recovery logic, eliminating the need for user input by deriving and using encryption keys from a system-wide password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a credential store is encrypted with a key derived from a master password, then security is improved, but the system requires user interaction when the password is changed
Solution Approach 1:
The patent introduces a lockbox as an intermediary component that stores multiple encryption keys. When the master password changes, the lockbox automatically provides the appropriate decryption key without requiring user interaction. The lockbox acts as a mediator between the credential store and the password management system, handling key retrieval and rotation automatically.
Solution Approach 2:
The system performs preliminary actions by pre-generating and storing multiple encryption keys in the lockbox before they are needed. When a password change occurs, the system can immediately retrieve the appropriate pre-computed key from the lockbox without requiring real-time user input or complex key derivation during the decryption process.
2Adaptability or versatility
If the same password is used for multiple services, then synchronization is improved, but security risk increases
Solution Approach 1:
The patent segments the password system by introducing distinct encryption keys for different services and contexts. Instead of using a single password-derived key for everything, the lockbox contains multiple segregated keys that can be selectively applied. This allows password synchronization across services while maintaining security isolation, as each service can use its own key without exposing other services' credentials.
Solution Approach 2:
The system applies local quality by allowing different encryption keys to be used in different contexts or for different services. The lockbox enables selective key application based on the specific service or credential being accessed, rather than using a uniform approach. This maintains synchronization capabilities while reducing security risks associated with password reuse.
3Extent of automation
If a lockbox with multiple encryption keys is implemented, then automatic decryption capability is improved, but device complexity increases
Solution Approach 1:
The lockbox is designed as a universal component that handles multiple encryption keys and serves multiple functions: storing keys, managing key rotation, and providing automatic decryption. By consolidating these functions into a single multi-functional module, the system achieves automatic decryption capability without proportionally increasing overall system complexity. The lockbox can be reused across different services and contexts.
Solution Approach 2:
The lockbox structure embeds multiple encryption keys within a single container object, similar to nested dolls. This hierarchical organization allows the system to manage multiple keys without creating separate complex structures for each key. The nested organization simplifies retrieval and management operations, as the entire key set is accessed through a single lockbox interface rather than multiple separate key management systems.
Data Source
AI summary
The present invention is a method, system and apparatus for the encryption of a credential store by using a lockbox mechanism. In a credential store encryption method, a lockbox for a credential store can be retrieved and an encryption key can be selected from among a list of encryption keys in the lockbox. The lockbox can be a local lockbox and the local lockbox can be retrieved from an unencrypted region of the credential store. In any case, subsequent to the retrieval of the lockbox, the credential store can be decrypted with the selected encryption key.