Mutual Dependency Architecture for Decentralized Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized cryptographic key storage systems are vulnerable to single points of failure, compromising security and privacy as attackers can target a single location to access private keys.
Innovation Solution
A hybrid decentralized method, referred to as mutual dependency architecture, where cryptographic keys are stored entirely on devices, with an encrypted seed transmitted to a central authority for authentication, ensuring that sensitive components never touch the central authority, and using hardware security modules for additional protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized key storage is used, then key management is simplified, but security is compromised due to single point of failure
Solution Approach 1:
The cryptographic key storage system is segmented into multiple independent components distributed across different devices. Each device holds a portion of the key material (encrypted seed) rather than a complete key, so that no single device contains the full cryptographic capability. This segmentation prevents any single point of failure from compromising the entire system while maintaining simplified key management through the distributed architecture.
2Reliability
If keys are stored entirely on devices, then security is improved by removing central vulnerability, but key recovery becomes difficult
Solution Approach 1:
A trusted third party server acts as an intermediary in the key recovery process. When a user loses access to their device, the server can facilitate key recovery by verifying the user's identity through alternative authentication methods and then providing the necessary information to restore access. This mediator enables key recovery without requiring centralized key storage, maintaining security while improving ease of operation for key recovery scenarios.
3Ease of operation
If encrypted seed is transmitted to central authority, then authentication is enabled, but attack surface is increased
Solution Approach 1:
The system extracts and removes the most sensitive cryptographic material (the unencrypted master key) from the central authority server. Instead, only encrypted seed data is transmitted to and stored on the server. The actual key decryption and cryptographic operations occur locally on user devices, not on the server. This extraction of sensitive operations from the central authority reduces the server's attack surface while maintaining authentication capabilities.
Data Source
AI summary
A decentralized and/or hybrid decentralized method for secure cryptography key storage referred to as Mutual Dependency Architecture (MDA) includes the steps of encrypting the cryptographic key using an unlock key; encrypting the unlock key using an encryption tool to create an encrypted seed; and storing the encrypted seed; wherein a user must have access to a first storage area in the device and to a second storage area external to the device in order to access the cryptographic key. In one embodiment, the encryption tool is a store key that is stored in unencrypted form in the first storage area, while the encrypted seed is stored in the second storage area. In another embodiment, the encryption tool is a Hardware Security Module (HSM) having an authentication key that is encrypted using a store key and stored in the second storage area, while the encrypted seed and the store key are stored in unencrypted form in the first storage area. The method can be used to build a fully encrypted and permanently secure network and/or internet of devices and/or things, and to exchange messages between devices on the network.