Multi-User Cryptographic Vault Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional credential management techniques face challenges such as reliance on a single point of failure, difficulty in managing and accessing sensitive data due to password or key sharing, and complexity in enforcing data security policies, especially when personnel changes occur.
Innovation Solution
A multi-user credential mechanism that uses a cryptographic vault key generated from multiple identity credentials, allowing for secure encryption and decryption with a minimum number of required credentials, enabling decentralized and offline management of sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single authorized person is responsible for handling sensitive data, then ease of operation is improved, but reliability deteriorates due to single point of failure
Solution Approach 1:
The patent segments the decryption authority by dividing the decryption key into multiple shares distributed to different authorized individuals. No single person holds complete decryption capability, eliminating the single point of failure while maintaining operational simplicity through automated key management.
2Reliability
If multiple authorized individuals are given access to sensitive data, then reliability is improved, but security exposure increases due to shared decryption passwords
Solution Approach 1:
The decryption key is segmented into multiple shares using secret sharing schemes. Each authorized individual receives only a portion of the key material, making it computationally infeasible to reconstruct the full decryption key without sufficient shares, thereby reducing security exposure while maintaining reliability.
Solution Approach 2:
Different authorized individuals have different levels of access based on their specific key shares. The system implements local quality by assigning specific decryption capabilities to specific individuals rather than providing universal access, reducing overall security exposure.
3Reliability
If multiple backup copies of encrypted data are kept in secure locations, then reliability is improved, but device complexity increases due to version control management
Solution Approach 1:
The system implements self-service through automated key management that handles version control, backup, and restoration without manual intervention. The key management system automatically tracks key versions, manages secure storage, and facilitates restoration processes, reducing device complexity while improving reliability.
4Reliability
If encryption and decryption information regularly changes, then security is improved, but loss of time increases due to key management overhead
Solution Approach 1:
The automated key management system performs key rotation, version control, and restoration operations without requiring manual intervention. This self-service capability allows frequent key changes to maintain security while minimizing the time loss associated with key management overhead.
Data Source
AI summary
Sensitive electronic data may be encrypted using multiple identity credentials from multiple parties. Before the sensitive electronic data is encrypted, the multiple N identity credentials are input to a software application. Moreover, a minimum number Nmin of the N of the identity credentials are selected for decryption. The software application thus generates at least one of an encryption key and a decryption key as a keypair based on the N identity credentials and the minimum number Nmin of the identity credentials. The software application encrypts the sensitive electronic data using the encryption key to generate an encrypted version. Before decryption of the encrypted version, though, the software application may require input of the minimum number Nmin of the identity credentials. If the minimum number Nmin of the identity credentials are correctly input, the correct decryption key is generated and may be used to decrypt the encrypted version.