Offline Secret Caching via Dual-Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy security techniques are inadequate for modern cloud-based environments, as they rely on outdated perimeters, are costly, complex, and vulnerable to security threats, particularly when users access resources without a network connection or with poor connectivity, leading to inefficiencies and security gaps.
Innovation Solution
The implementation of a system that securely caches and provisions secrets using cryptographic keys for offline access, allowing passwordless authentication through dual-mode authentication involving physical and session-based verification, with secret splitting to enhance security, even when network connections are unreliable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store sensitive documents or data locally to access them offline, then accessibility without network connection is improved, but security vulnerabilities and gaps increase
Solution Approach 1:
The secret is divided into multiple portions and stored in different locations (endpoint computing resource and auxiliary computing device). This segmentation ensures that no single location contains the complete secret, reducing security risks while enabling offline access when portions are combined.
Solution Approach 2:
A security server acts as an intermediary to manage secret portions and cryptographic keys. The server coordinates the distribution and combination of secret portions without requiring continuous network connection, enabling secure offline access while maintaining centralized security control.
2Reliability
If legacy security techniques with firewalls and perimeters are used, then network security control is improved, but device complexity and cost increase
Solution Approach 1:
The secret combination operation is extracted from the network environment and performed locally on the endpoint computing device. This eliminates the need for complex firewall rules and perimeter security mechanisms, simplifying the system while maintaining security through cryptographic operations.
Solution Approach 2:
The endpoint computing device performs secret combination and authentication locally without requiring continuous network verification or complex security infrastructure. The device serves its own authentication needs using stored secret portions and cryptographic keys, reducing overall system complexity.
3Reliability
If passwords are used for authentication, then security verification is improved, but ease of operation and user burden worsen
Solution Approach 1:
The mechanical password entry system is replaced with biometric authentication (fingerprint, facial recognition, etc.). This substitution maintains strong security verification while dramatically improving user convenience by eliminating the need to remember and manually enter passwords.
4Ease of operation
If biometric authentication alone is used, then ease of operation is improved, but security reliability worsens due to vulnerability to attacks
Solution Approach 1:
Multiple authentication factors are combined in a composite authentication mechanism: biometric data, secret portions from multiple sources, and cryptographic key verification. This composite approach maintains the convenience of biometric authentication while adding layers of security that protect against attacks on any single factor.
Data Source
AI summary
Disclosed embodiments relate to securely caching and provisioning secrets for use in an offline process. Techniques include accessing, at an endpoint computing resource storing a secret, a first cryptographic key; encrypting the secret using the first cryptographic key; receiving, from an auxiliary device, a second cryptographic key; encrypting the encrypted secret with the second cryptographic key to produce an encrypted block; sending, without using a network connection, the encrypted block to the auxiliary device for decryption; receiving, from the auxiliary device and without using a network connection, a decrypted version of the encrypted block; and decrypting the encrypted secret with a cryptographic key corresponding to the first cryptographic key.