Pre-Encrypted Key Decryption via Client-Side Wrapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage systems face security risks due to compromised encryption keys, as both the data and keys are often stored on the same system, making them vulnerable to unauthorized access, even when using external key managers.
Innovation Solution
Implementing a key decryption component that utilizes client-side wrapping keys to generate and store cryptographic keys, ensuring that the key manager does not access or see the wrapping key, thereby protecting the actual decryption key from unauthorized access, even if the key manager is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If keys are stored on the same storage system as encrypted data, then key management is simplified, but security is compromised due to increased vulnerability to unauthorized access
Solution Approach 1:
The encryption key is divided into two separate components: a first key stored by the key manager and a second key (wrapping key) stored by the client. This segmentation ensures that neither key alone can decrypt the encrypted data, resolving the contradiction by separating key management functions while maintaining security through distributed key storage.
Solution Approach 2:
A wrapping key is introduced as an intermediary layer between the client and the key manager. The wrapping key encrypts the first key before transmission to the key manager, creating a trusted intermediary mechanism that allows key management simplicity while ensuring security through layered encryption.
2Reliability
If an external key manager is used to store keys separately, then security is improved, but trust requirements increase as the client must fully trust the key manager
Solution Approach 1:
The encryption key is segmented into two parts stored in different locations: the first key with the key manager and the second key (wrapping key) with the client. This segmentation reduces trust requirements by eliminating the need for complete trust in the key manager, as the client retains control of the wrapping key.
Solution Approach 2:
Instead of the key manager trusting the client with the full key, the approach is inverted: the client trusts the key manager only with the encrypted first key, while the client maintains the wrapping key locally. This inversion of trust relationships reduces the complexity of the trust architecture.
3Productivity
If a professional service key manager is used to serve multiple clients, then resource utilization is improved, but security risks increase due to potential compromise of shared key storage
Solution Approach 1:
Each client's encryption key is segmented into two parts: the first key stored by the shared key manager and the second key (wrapping key) stored exclusively by that client. This segmentation allows resource utilization benefits of shared key management while maintaining security through client-specific wrapping keys that prevent cross-client key compromise.
Solution Approach 2:
The wrapping key has local quality specific to each client, meaning each client generates and retains their own unique wrapping key. This local quality ensures that even in a shared key manager environment, each client's security remains independent and cannot be compromised through other clients' access.
Data Source
AI summary
Examples are generally directed towards providing key decryption for pre-encrypted keys. On identifying a portion of encrypted data to be decrypted, a computing device obtains a pre-encrypted key from a key manager. The pre-encrypted key is a random number generated by the key manager. The computing device decrypts the pre-encrypted key with a client-side wrapping key to obtain an actual key. The computing device decrypts the portion of the encrypted data with the actual key. The key manager is an un-trusted key manager without access to the wrapping key or the actual key. An unauthorized party obtaining access to the encrypted data and the pre-encrypted key stored by the key manager does not provide enough information to enable decrypting the encrypted data without also obtaining access to the client-side wrapping key stored remotely from the key manager.