Secret and Key Store Separation for Granular Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure systems face challenges in managing access to encrypted data, often providing all-or-nothing access and lacking granular control, which can lead to security issues due to human error or third-party service vulnerabilities.
Innovation Solution
The system generates encrypted data on a client device using an encryption key, storing it in a secret store and the key in a key store, both managed by separate entities with exclusive access control rights, allowing for granular access management and separation of administrative controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all-or-nothing access is provided to secret data, then ease of operation is improved, but security is worsened due to lack of granular control
Solution Approach 1:
The patent segments access control into two separate stores: a secret store containing encrypted data and a key store containing encryption keys. Each store has its own administrative access control rights, allowing granular control where different identities can have different levels of access to each store independently, thus resolving the contradiction between ease of operation and security control.
2Adaptability or versatility
If third-party entities host security services, then functionality is improved, but security is worsened due to potential vulnerabilities in third-party services
Solution Approach 1:
The patent separates the hosting entity from the security-critical components by dividing storage into two independent stores with different administrative controls. The client device maintains control over encryption keys while encrypted data can be hosted third-party, allowing functionality improvement while mitigating security risks through architectural segmentation.
Solution Approach 2:
The patent introduces encryption as an intermediary mechanism between the client device and third-party hosting services. The encryption key acts as a mediator that allows the client to control access to encrypted data even when stored on third-party infrastructure, thus maintaining security trust while utilizing third-party functionality.
3Reliability
If administrative access control rights are separated between secret store and key store, then security is improved through granular control, but device complexity is worsened
Solution Approach 1:
The patent divides the security system into two separate stores with distinct administrative access control rights, enabling granular control where different identities can manage each store independently. This segmentation improves security by preventing single-point compromise while the modular design keeps each store's complexity manageable.
Data Source
AI summary
Technologies described herein provide enhanced security for storing and updating secret data, such as a password. Based on one or more conditions, an existing encryption key or a new encryption key may be used to generate encrypted data at a client computing device. The encrypted data may be communicated from the client computing device to a secret store managed by a first entity for storage of the encrypted data in the secret store. Based on one or more conditions, the new encryption key may be communicated from the client computing device to a key store managed by a second entity for storage of the new encryption key in the key store.