Decryption Key Management via Remote Key-Server Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in securely managing decryption keys, particularly in scenarios where computing devices are vulnerable to theft, as storing keys on the device can lead to unauthorized access, and hardware security modules may not be economically viable or secure.
Innovation Solution
A method where a computing device generates and encrypts a decryption key, storing the encrypted key on a separate key-server, using authentication keys to securely retrieve and manage the decryption key, and periodically changing or re-encrypting data to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the decryption key is stored on the computing device, then data can be decrypted and accessed, but the device becomes vulnerable to theft and unauthorized access
Solution Approach 1:
The decryption key is extracted from the computing device and stored on a separate key-server. The device only retains encrypted data and the ability to request keys, eliminating the security vulnerability of storing keys locally while maintaining data accessibility through remote key retrieval.
Solution Approach 2:
A key-server acts as an intermediary between the computing device and the decryption key. The key-server securely stores keys and provides controlled access, mediating between the need for data accessibility and the need to prevent unauthorized key exposure.
2Reliability
If hardware security modules are used to protect decryption keys, then security is enhanced, but economic costs increase
Solution Approach 1:
Instead of expensive hardware security modules, the system uses software-based cryptographic operations on standard computing devices. The decryption keys are stored remotely on key-servers using conventional storage, eliminating the need for costly hardware security infrastructure while maintaining security through cryptographic protocols.
3Object-affected harmful factors
If the decryption key is stored on a separate key-server, then device security is improved, but key retrieval complexity increases
Solution Approach 1:
The key-server provides multiple functions: secure key storage, authentication verification, key retrieval, and periodic key rotation. This multi-functional approach consolidates key management complexity into a single centralized system rather than distributing complexity across multiple components.
Solution Approach 2:
The computing device automatically manages key retrieval through authenticated requests to the key-server. The system handles key lifecycle management including periodic changes and re-encryption without manual intervention, making the complexity transparent to users while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and a method are provided for retrieving decryption keys from a secure location that is separate from the encrypted data. In particular, for each decryption key, there is an associated key ID, public and private authentication key pair and a storage key. The decryption key is encrypted and can be decrypted with the storage key. A key-server securely stores the encrypted decryption key, key ID and public authentication key. A separate key-host stores the storage key, key ID and private authentication key. For the key-host to retrieve the encrypted decryption key, the key-server first authenticates the key-host using the authentication keys. Upon receipt of the encrypted decryption key, the key-host decrypts the encrypted key using the storage key. The decryption key is then used for decrypting the encrypted data.