Randomized Data Partitioning for Secure Credential Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for digital secrets are compromised when keys or credentials are shared or stored unencrypted, leading to potential unauthorized access.
Innovation Solution
Implementing a security component that randomly partitions and stores data segments across non-contiguous memory locations using reproducible pseudorandom algorithms, with dynamically determined sizes and storage locations, and an access threshold to enhance security and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If keys or credentials are stored unencrypted or shared with users, then ease of operation is improved, but security is compromised
Solution Approach 1:
The security credential is divided into multiple data segments that are stored separately in non-contiguous memory locations. Each segment alone is insufficient to reconstruct the original credential, providing security while allowing controlled access. The segmentation principle resolves the contradiction by enabling operational access to necessary components while protecting the complete secret through distributed storage.
Solution Approach 2:
The system dynamically determines partition sizes and storage locations using reproducible pseudorandom algorithms during runtime rather than using fixed predetermined values. This dynamic behavior makes it difficult for attackers to predict or locate credential segments, enhancing security while maintaining operational functionality through programmatic access control.
2Ease of operation
If data is stored in fixed locations with predetermined partition sizes, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system uses dynamic runtime determination of partition sizes and storage locations through reproducible pseudorandom algorithms. This creates unpredictable, changing storage patterns that prevent attackers from easily locating or extracting credential segments, directly addressing the vulnerability to hacking while maintaining operational access through controlled reconstruction.
Solution Approach 2:
The system introduces an intermediary layer of pseudorandom algorithm processing between the stored data segments and the reconstructed credential. This intermediary mechanism requires authorized computational verification to assemble the segments correctly, adding a security barrier that prevents direct access while allowing legitimate operations.
3Ease of operation
If data segments are stored in contiguous memory locations, then ease of operation is improved, but security is worsened due to easier detection and extraction
Solution Approach 1:
The credential is segmented into multiple distributed parts stored in non-contiguous memory locations. This segmentation increases the difficulty of detection and extraction by attackers who would need to locate and combine multiple scattered segments, while the system maintains operational simplicity through programmed knowledge of segment relationships.
Solution Approach 2:
The system transitions from one-dimensional contiguous storage to multi-dimensional distributed storage across non-contiguous memory locations. This dimensional change complicates detection and extraction efforts by requiring searches across multiple memory regions, while operational retrieval remains efficient through coordinated access to the distributed segments.
Data Source
AI summary
Apparatuses, methods, systems, and program products are presented for securing data based on randomization. An apparatus includes a security component that is configured to determine, during compile time of an application, at least one random value used to determine a partition size, a set of storage locations, and an access threshold for a data element during execution of the application. An apparatus includes a partition module that is configured to partition a data element into a plurality of data segments that each have a size that is randomly determined, during execution of an application, based on at least one random value to determine the partition size. An apparatus includes a storage module that is configured to randomly determine a first set of storage locations for a plurality of data segments, during execution of an application, based on at least one random value for the set of storage locations.