Origin Key Management via Secret Sharing and Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing card verification systems face challenges in securely managing origin keys for cryptographic authentication, particularly in ensuring that origin keys are not stored unnecessarily and can be recovered if the entity issuing the payment card experiences disruptions.
Innovation Solution
The system creates super origin keys, diversifies them into origin keys, generates secret sharing portions, divides and encrypts these portions, and transmits them to multiple entities, allowing secure recovery and recreation of origin keys using vendor IDs and super origin keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If origin keys are stored securely, then security is improved, but key recovery capability deteriorates
Solution Approach 1:
The origin key is segmented into multiple secret sharing portions using secret sharing schemes. Each portion alone is insufficient to reconstruct the key, but a threshold number of portions enable recovery. This segmentation allows secure storage distributed across multiple entities while maintaining key recovery capability through controlled reconstruction.
Solution Approach 2:
A key recovery intermediary system is introduced that mediates between secure key storage and key recovery operations. The intermediary holds metadata and coordinates the reconstruction process by collecting sufficient secret sharing portions from distributed storage locations and facilitating key regeneration without requiring direct access to the original key material.
2Reliability
If origin keys are distributed to multiple entities, then security is improved, but system complexity deteriorates
Solution Approach 1:
The secret sharing portions are designed with universal applicability across multiple entities and use cases. The same portion can serve different security requirements and be used by multiple authorized entities without requiring entity-specific customization. This reduces system complexity by eliminating the need for separate key management systems for each entity.
Solution Approach 2:
The system allows dynamic adjustment of security parameters such as the threshold number of portions required for key reconstruction and the number of entities receiving portions. These parameter changes enable the system to adapt to different security requirements without fundamental architectural changes, reducing complexity while maintaining flexibility.
3Reliability
If secret sharing portions are divided into multiple parts, then security is improved, but key management complexity deteriorates
Solution Approach 1:
The secret sharing portions are copied and distributed to multiple entities in controlled manner. Each entity receives identical or equivalent portions that can be used for key reconstruction. This copying approach simplifies management by allowing redundant distribution of the same cryptographic material rather than requiring unique complex key structures for each entity.
Solution Approach 2:
Secret sharing portions are pre-divided and distributed to entities before any key recovery scenario occurs. The preliminary distribution establishes a ready-to-use framework where key recovery can be executed by simply collecting the predetermined number of portions without requiring complex real-time computation or decision-making during recovery operations.
4Reliability
If encrypted multiple parts are transmitted to multiple entities, then security is improved, but communication overhead deteriorates
Solution Approach 1:
The system extracts and transmits only the essential secret sharing portions to entities, removing unnecessary redundant data. Each transmitted portion contains precisely the cryptographic material needed for potential key reconstruction without extraneous information. This extraction approach minimizes communication overhead while maintaining the security benefits of distributed key management.
Data Source
AI summary
A method for managing origin keys for cryptographic authentication is provided. The method includes creating, by a server, at least one super origin key and diversifying, by the server, the at least one super origin key into at least one origin key. The method further includes generating, by the server, a plurality of secret sharing portions of the at least one origin key, dividing, by the server, the plurality of secret sharing portions into multiple parts, encrypting, by the server, the multiple parts of the plurality of secret sharing portions, and transmitting, by the server, the encrypted multiple parts of the plurality of secret sharing portions to multiple entities.