Distributed Private Key Fragmentation for Blockchain Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In blockchain-based data sharing systems, private keys are vulnerable to leakage, leading to potential property loss for users, as they are often stored in insecure formats like irregular character strings and memos, making them susceptible to theft or loss.
Innovation Solution
A method and apparatus for securely storing account addresses and private keys by encrypting them with a password and fragmenting the ciphertext across multiple databases, ensuring that even if the password is stolen, the encrypted data cannot be restored without the encryption password, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If private keys are stored in irregular character strings and memos for ease of memorization, then ease of operation is improved, but security deteriorates as they become susceptible to theft or loss
Solution Approach 1:
The patent divides the private key into multiple fragments using secret sharing technology. Each fragment is stored separately in different locations or devices. To reconstruct the original private key, a threshold number of fragments are required, making it secure against single-point breaches while still allowing legitimate users to access their keys through distributed storage.
Solution Approach 2:
The patent introduces a trusted third-party service or secure vault as an intermediary to manage and protect private keys. This intermediary encrypts and stores keys using advanced cryptography, providing users with secure key management without requiring them to manually handle sensitive key materials, thus balancing security with ease of use.
2Ease of operation
If account addresses and private keys are stored in plain text or simple formats, then ease of operation is improved, but security deteriorates due to vulnerability to leakage
Solution Approach 1:
The patent transforms the storage format of private keys from plain text to encrypted binary formats using strong cryptographic algorithms. The keys are encoded in secure formats that are not human-readable but can be programmatically accessed through authorized applications, changing the parameter of readability while maintaining security and programmatic accessibility.
Solution Approach 2:
The patent implements preliminary encryption and authentication mechanisms before storing private keys. Security measures such as password protection, biometric authentication, and encryption are applied in advance during key generation and storage, so that when the keys are accessed later, the security infrastructure is already in place to protect against theft and leakage.
3Ease of operation
If private keys are stored in centralized locations for easy management, then ease of operation is improved, but security deteriorates as centralized storage becomes a single point of failure
Solution Approach 1:
The patent fragments private keys into multiple parts and distributes them across different storage locations, devices, or even different users. This segmentation eliminates the single point of failure inherent in centralized storage, as an attacker would need to compromise multiple distributed locations simultaneously to obtain the complete key, while legitimate users can reconstruct keys by gathering the required threshold of fragments.
Solution Approach 2:
The patent transitions from single-dimensional centralized storage to multi-dimensional distributed storage. Instead of storing keys in one location, the system distributes key fragments across multiple dimensions including different physical locations, device types, and security domains, creating a resilient architecture that maintains security while enabling convenient access through authorized reconstruction.
Data Source
AI summary
The present disclosure discloses an information storage method performed at a server. The method includes: receiving an information storage request sent by a terminal device, the information storage request carrying a first user identifier, an account address, and a to-be-stored ciphertext; performing identity authentication on a user according to a the first user identifier when receiving an information storage request sent by a terminal device, the information storage request carrying the first user identifier, an account address, and a to-be-stored ciphertext; generating a serving end serialization factor according to preset configuration information if after the identity authentication succeeds; obtaining a plurality of ciphertext fragments of the to-be-stored ciphertext according to the serving end serialization factor and the to-be-stored ciphertext; and storing the account address corresponding to the first user identifier, and respectively storing, corresponding to the account address, the plurality of ciphertext fragments into different ciphertext databases.