Multi-Cloud Key Segmentation for Successive Partial Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public key cryptography is vulnerable to attacks involving private key theft or impersonation, especially in cloud computing environments where data and keys are stored outside user control, leading to trust issues and the need for a single provider to decrypt encrypted data.
Innovation Solution
Generate multiple private keys, distribute them to separate cloud providers, and enable partial decryption at each provider to ensure no single provider can fully decrypt the data, using modular multiplicative inverses factored into multiple factors for linked decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single private key is used for decryption in cloud computing environments, then decryption can be performed by a single provider, but security is compromised because the private key may be stolen or the provider may be compromised
Solution Approach 1:
The private key is segmented into multiple factors (first factor, second factor, etc.) that are distributed to different cloud providers. Each provider holds only a portion of the key material, making it impossible for any single provider to decrypt the encrypted message alone. This segmentation resolves the security vulnerability while maintaining a manageable decryption system.
Solution Approach 2:
The encrypted message serves as an intermediary that requires combination of multiple key factors for decryption. The system introduces a multi-provider coordination mechanism where each provider acts as an intermediary that contributes their key factor to the collective decryption process, preventing any single point of failure or compromise.
2Reliability
If multiple private keys are distributed to separate cloud providers for partial decryption, then security is enhanced by preventing single-point compromise, but the decryption process complexity increases
Solution Approach 1:
The decryption process is segmented into multiple independent steps, each performed by a different cloud provider using their respective key factors. This segmentation enhances security by distributing trust while keeping each individual decryption step relatively simple and well-defined.
Solution Approach 2:
The results from multiple partial decryption operations are merged to produce the final decrypted message. This combining step consolidates the outputs from different providers in a straightforward manner, managing the overall process complexity despite the distributed nature of the decryption.
3Adaptability or versatility
If private keys are stored in cloud environments outside user control, then data storage flexibility is improved, but trust issues arise and private keys may be accessed by unauthorized parties
Solution Approach 1:
The private key material is segmented and distributed across multiple cloud providers, so that no single provider has access to the complete key. This maintains the flexibility of cloud storage while mitigating trust issues, as compromise of any single provider does not result in complete key exposure.
Solution Approach 2:
Each cloud provider is assigned a specific portion of the key material with specific security requirements and access controls tailored to their role. This local quality approach allows each provider to maintain their own security posture while collectively providing enhanced key protection through distribution.
Data Source
AI summary
Systems and methods for data encryption and decryption requiring successive partial decryption using multiple keys. The method is designed to generate a public key used to encrypt plaintext into an encrypted message and to generate multiple private keys, each of which are different from one another and are transmitted to separate computing devices to be used for decryption. The encrypted message is sent to one computing device for partial decryption using one private key, and the partial decryption is sent to another computing device for partial decryption using a different private key to generate the plaintext.