Secret-Sharing Cloud Storage with Two-Path Key Separation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data storage systems face challenges in ensuring data confidentiality by requiring encryption keys to be stored at user locations, which increases vulnerability to attacks and burdens the user with encryption management.

Innovation Solution

A secret sharing-based storage system employs two-path communication between user locations and cloud servers, where encrypted data is distributed across multiple cloud servers without the need for encryption keys at the user location, using XOR operations and shared encryption keys for secure data storage and retrieval.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption keys are stored at user locations to ensure data confidentiality, then data security is improved, but the vulnerability to attacks and user burden increase

Engineering Contradiction:

Improvedata securityVSAvoidvulnerability to attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The encryption key is divided into multiple key fragments using secret sharing technology. Each fragment is stored at different user locations rather than keeping the complete key at one location. This segmentation ensures that no single location holds the full capability to decrypt data, reducing the vulnerability to attacks while maintaining data security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A key management server is introduced as an intermediary to manage and distribute key fragments to user locations. The server coordinates the secure storage and retrieval of key fragments without requiring user locations to store complete encryption keys, thereby reducing vulnerability while maintaining security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If encryption keys are stored at user locations to enable data decryption, then data accessibility is improved, but the complexity of key management increases

Engineering Contradiction:

Improvedata accessibilityVSAvoidkey management complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The complexity of key management is extracted from user locations and centralized at a key management server. The server handles key fragment distribution, storage coordination, and retrieval operations, allowing user locations to simply store and access key fragments without managing the complete key or complex key management processes.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system enables automated key fragment management where the key management server automatically distributes, stores, and retrieves key fragments without requiring manual intervention at user locations. This self-service approach simplifies operations while maintaining security through automated processes.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20250310097A1Secret sharing-based storage system and secret sharing-based storage method

Publication Date: 2025.10.02 KK TOSHIBA

AI summary

According to one embodiment, a secret sharing-based storage system includes N cloud servers and a secret sharing device. The secret sharing device receives second data obtained by encrypt first data using an encryption key from a user terminal, generates N distributed data by executing distribution processing on the second data, and stores the N distributed data separately in N cloud servers. The system executes two-path communication between the user terminal and each of the N cloud servers. The first path is for sending second data from the user terminal to the secret sharing device and for sending the distributed data from the secret sharing device to the cloud server. The second path is for sending the encryption key from the user terminal to the cloud server.