On-chain Key Fragment Management for Off-chain Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing blockchain systems face challenges in securely managing and exchanging encryption keys for off-chain data storage, leading to vulnerabilities and unauthorized access risks.
Innovation Solution
A system that splits and encrypts encryption keys into fragments, storing them on a blockchain ledger, allowing only authorized nodes to reconstruct the key for accessing off-chain stored files, thereby ensuring secure key management and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are managed off-chain, then key exchange flexibility is improved, but security vulnerability increases
Solution Approach 1:
The encryption key is divided into multiple key fragments using secret sharing schemes. Each fragment is stored on different blockchain nodes, and no single node possesses the complete key. This segmentation prevents unauthorized access while maintaining key management flexibility through distributed storage.
Solution Approach 2:
The blockchain ledger acts as an intermediary layer between key management and data access. Instead of direct off-chain key exchange, the system uses on-chain key fragments with cryptographic proofs to mediate access control, eliminating the need for secure private channels while maintaining security.
2Reliability
If encryption keys are stored on-chain, then security control is improved, but storage capacity requirements increase
Solution Approach 1:
The complete encryption key is segmented into multiple smaller key fragments distributed across the blockchain ledger. Each fragment occupies minimal storage space, yet collectively they provide robust security control. This approach avoids storing the entire key in one location while maintaining distributed security.
Solution Approach 2:
Different key fragments are strategically placed on different blockchain nodes based on their public keys. Each node stores only the fragment corresponding to its public key, optimizing storage distribution. This local quality assignment ensures that each node has the specific key material needed for its designated access control function without redundant storage.
3Ease of operation
If complete encryption keys are distributed to authorized users, then access flexibility is improved, but unauthorized access risk increases
Solution Approach 1:
Instead of distributing complete encryption keys to authorized users, the system distributes key fragments. Each user receives only a portion of the key material, which is useless without the other fragments. This segmentation maintains access flexibility through cryptographic reconstruction while eliminating unauthorized access risk since no single user possesses the complete key.
Solution Approach 2:
The system implements cryptographic verification mechanisms where key fragments are accompanied by proofs of authorized reconstruction. This feedback loop ensures that only authorized combinations of key fragments can successfully reconstruct the encryption key, providing real-time verification of access legitimacy while maintaining operational flexibility.
Data Source
AI summary
An example operation may include one or more of splitting an encrypted file into a plurality of file fragments, distributing the file fragments to a plurality of storing peers for storing the file fragments off-chain, splitting an encryption key used to encrypt the file into a plurality of key fragments, encrypting each key fragment using a public key of a different storing peer, and storing the respectively encrypted key fragments on the distributed ledger such that each encrypted key fragment is associated with the encrypted file.