Partial Key Storage via Slot Server Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 'password spiral of death' occurs when cryptographic keys used for encrypting sensitive data create an endless loop of encryption, leading to user frustration, insufficient security, and burdensome key management tasks, as each key needs to be encrypted, resulting in a complex and insecure system.
Innovation Solution
A system and method for managing restricted access split cryptographic keys, where a slot server generates and stores partial keys separately from the user device, requiring both partial keys from different locations to decrypt data, enhancing security by limiting access based on IP addresses and authentication methods, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored on user devices to enable data decryption, then data accessibility is improved, but security is worsened due to key exposure
Solution Approach 1:
The cryptographic key is divided into multiple partial keys stored on different devices (user device and server). The user device stores a first partial key with the encrypted data, while the server stores a second partial key. Both partial keys are required to reconstruct the full composite key for decryption, eliminating the need to store the complete key on any single device.
2Extent of automation
If complete cryptographic keys are stored on servers for centralized key management, then key management control is improved, but security is worsened due to centralized key exposure
Solution Approach 1:
The key is segmented into partial keys distributed across multiple locations. The server stores only a partial key and uses it to generate slot values for accessing encrypted data, but cannot decrypt data alone. The user device holds another partial key. This distribution eliminates the single point of failure and prevents complete key exposure on the server.
3Reliability
If multiple encryption layers are implemented to protect keys, then security is improved, but system complexity increases creating the password spiral of death
Solution Approach 1:
A slot server acts as an intermediary between the user device and the encrypted data. The slot server receives slot values from the user device, uses them to access partial keys stored on the server, and returns the necessary key portions for decryption. This intermediary architecture simplifies the user device by removing the need for complex key management logic while maintaining security through distributed key storage.
Data Source
AI summary
Examples provide a system for managing access-restricted partial cryptographic keys for encrypting and decrypting data. In some examples, a slot server generates and stores a first partial key. The first partial key is access-restricted based on access control data. A slot value mapped to the storage location is returned to the client by the slot server. The client generates a second partial key which is stored at the client device with the slot value. To obtain the first partial key, the client sends a request to the slot server, including the slot value. The requesting client is validated using access control data. If the request comes from a validated client, the slot server provides the first partial key to the client. The first partial key and the second partial key are combinable to generate a composite key for encrypting and decrypting data.