Quorum-Based Passphrase Reconstruction for Distributed Encrypted Volumes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As network computing and data storage systems scale, controlling access to sensitive data becomes increasingly complex, especially in distributed environments where unauthorized access poses a significant risk.
Innovation Solution
The implementation of key derivation hosts that utilize a secret sharing algorithm to securely manage and encrypt sensitive information, ensuring that only a quorum of shares can reconstruct the passphrase for accessing encrypted volumes, thereby enhancing security and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed data storage is implemented across multiple locations to improve availability and access, then data availability and access efficiency are improved, but security control and access management become more complex and vulnerable to unauthorized access
Solution Approach 1:
The passphrase is segmented into multiple shares using secret sharing algorithms, with each share distributed to different key derivation hosts. This segmentation allows the system to maintain data availability across distributed locations while controlling access complexity through defined quorum requirements.
Solution Approach 2:
Key derivation hosts act as intermediaries between the encrypted data and the decryption process. These intermediaries hold shares of the passphrase and coordinate to reconstruct it when needed, simplifying access control management while maintaining security across the distributed system.
2Device complexity
If centralized key management is used to simplify access control, then security management is simplified, but single points of failure and reduced availability occur
Solution Approach 1:
The centralized key management function is segmented across multiple key derivation hosts, each holding a share of the passphrase. This eliminates single points of failure while maintaining manageable complexity through the secret sharing framework and quorum-based access control.
Solution Approach 2:
Multiple key derivation hosts are merged into a collaborative system where they collectively perform key management functions. The hosts work together to reconstruct passphrases when needed, combining their individual shares to achieve the security and availability benefits of both distributed and centralized approaches.
3Object-affected harmful factors
If multiple key derivation hosts are required to reconstruct the passphrase for security, then unauthorized access risk is reduced, but access time and operational complexity increase
Solution Approach 1:
The system requires only a quorum of key derivation hosts (k out of n) to reconstruct the passphrase, rather than requiring all hosts. This partial action approach maintains security by requiring multiple participants while reducing access time compared to requiring unanimous participation.
Solution Approach 2:
Key derivation hosts pre-establish their shares and cryptographic credentials in advance through secure enrollment processes. This preliminary action enables faster passphrase reconstruction during access operations, as the hosts already have their cryptographic materials ready and configured.
Data Source
AI summary
The present disclosure relates to generating a passphrase for an encrypted volume by at least cryptographically combing the first cryptographic key and the shared secret. Where the shared secret is split into a plurality of shares and a first number of the plurality of shares is greater than a second number of the plurality of shares and the second number of the plurality of shares is required to reconstruct the shared secret.