Multi-Repository Key Management for Cost-Security Balance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key management systems, such as Realsec's HSM, face a challenge in achieving a balance between centralized storage and management capabilities and security capabilities, leading to excessive costs for maintaining less critical keys.
Innovation Solution
A multi-repository manager system that centrally stores and manages cryptographic keys across different repositories, allowing for varying security levels based on key criticality, using a highly secure HSM for critical keys and conventional databases for non-critical keys, enabling flexible and cost-effective key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all cryptographic keys are stored in a centralized HSM with high security capabilities, then security control and supervision are improved, but storage and management costs increase excessively for less critical keys
Solution Approach 1:
The patent applies local quality by differentiating security levels across different repositories based on key criticality. Critical keys are stored in high-security HSM repositories while non-critical keys are stored in conventional database repositories, allowing each repository to have security capabilities matched to its specific needs rather than uniformly applying high security to all keys.
Solution Approach 2:
The patent segments the cryptographic key storage system into multiple repositories with different security levels. The multi-repository manager divides keys into critical and non-critical categories and stores them in appropriately secured repositories, separating the high-cost HSM resources from keys that do not require such protection.
2Ease of operation
If cryptographic keys are stored locally in end-user computers, then accessibility and operation ease are improved, but security control and supervision deteriorate
Solution Approach 1:
The patent introduces a multi-repository manager as an intermediary between end-user applications and the cryptographic key repositories. This manager provides centralized control and supervision over all keys while maintaining ease of operation for users, as the transparent interface allows applications to access keys without users needing to know the underlying storage architecture or security measures.
Data Source
Figure 1
AI summary
System for performing a cryptographic operation, comprising a client system and a server system;said server comprising a multi-repository manager, repositories of cryptographic keys,a processor and a memory;and said client comprising a processor and a memory;wherein said two memories store computer executable instructions that, when executed, cause the client and the server to perform a method comprising: the client sending a request of the cryptographic operation to the server;the multi-repository manager obtaining a set of references to cryptographic keys allowed to the request from the repositories of cryptographic keys; the multi-repository manager establishing a cryptographic key referenced in said set of references as the cryptographic key to be used; the multi-repository manager requesting performance of the cryptographic operation to the repository wherein the cryptographic key to be used is stored;the multi-repository manager obtaining the result of the cryptographic operation from the repository that has performed the cryptographic operation; and the server sending the result of the cryptographic operation to the client.