Multi-Authority Decryption Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encryption systems do not provide a secure method for allowing entities other than the intended recipient to decrypt information without using a backdoor or key escrow, which can lead to unauthorized access to sensitive data.
Innovation Solution
A system where a decryption key is split into multiple parts and encrypted for multiple controlling authorities, requiring cooperation from a designated number of these authorities to reconstruct and decrypt the key, ensuring that no single entity can access the encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single decryption key is used for secure encryption, then data security is improved, but the ability to enable other entities to decrypt the information is lost
Solution Approach 1:
The decryption key is divided into multiple key parts, each held by different controlling authorities. This segmentation allows the system to maintain security while enabling controlled access by multiple entities, as no single entity possesses the complete key alone.
Solution Approach 2:
The system dynamically adjusts decryption access by requiring a threshold number of key parts from controlling authorities. This dynamic approach allows flexibility in enabling different entities to decrypt information based on policy requirements without compromising the underlying security architecture.
2Adaptability or versatility
If a backdoor or key escrow is used to enable other entities to decrypt information, then decryption capability is improved, but unauthorized access to sensitive data becomes possible
Solution Approach 1:
By segmenting the decryption key into multiple parts distributed among controlling authorities, the system eliminates the need for a centralized backdoor or key escrow. This distribution ensures that no single entity can access the complete key alone, thereby preventing unauthorized access while maintaining decryption capability.
Solution Approach 2:
The system introduces controlling authorities as intermediaries that hold key parts and participate in the decryption process through policy-based authorization. This intermediary mechanism enables controlled decryption capability without creating a vulnerable centralized backdoor, as each intermediary only possesses a fragment of the complete key.
3Reliability
If the decryption key is split into multiple parts, then security against single entity access is improved, but system complexity increases
Solution Approach 1:
The key segmentation approach divides the decryption key into multiple parts, improving security against single entity access. While this increases complexity, the systematic distribution and management of key parts among controlling authorities provides a structured framework that balances security enhancement with manageable system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for enabling data encryption control are described. A requesting entity may request to decrypt an encrypted message. The authorization for the requesting entity to decrypt the encrypted message may be performed by a plurality of controlling authorities. The decryption key for decrypting the encrypted message may be split and encrypted specifically for the plurality of controlling authorities, so that no single controlling authority has enough information to decrypt the encrypted message. A designated number of the controlling authorities may be requested to decrypt an encrypted key part in order for the requesting entity to be authorized to reconstruct the decryption key.