Decentralized Secret Sharing With Guardian Verification and Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secret sharing schemes require trust in participants, are vulnerable to single points of failure, and face challenges in secure distribution and recovery, especially due to the need for centralized storage and potential collusion among participants.
Innovation Solution
A decentralized secret sharing method that distributes shares among unknown participants without requiring trust, using asynchronous communication and key rotation to ensure secure distribution and recovery, with verification mechanisms to confirm share possession and redistribute if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional secret sharing schemes are used, then secret distribution can be achieved, but trust in participants is required which creates vulnerability to collusion and loss
Solution Approach 1:
The patent introduces a decentralized verification system where participants can verify share possession through cryptographic proofs without requiring trust in central authorities or other participants. The verification mechanism acts as an intermediary that enables trustless validation of share integrity and possession.
Solution Approach 2:
The system implements feedback mechanisms where participants receive verification confirmations about their share status. This allows continuous monitoring of share possession and integrity, enabling participants to detect and report issues with share loss or collusion attempts without requiring prior trust.
2Ease of operation
If centralized storage is used for secret sharing, then data recovery is simplified, but single points of failure and brute-force attacks become possible
Solution Approach 1:
The patent segments the secret into multiple shares distributed across different participants, eliminating centralized storage. Each participant holds a portion of the secret, and no single point controls the entire secret or can reconstruct it alone, thereby removing single points of failure while maintaining recovery capability through threshold mechanisms.
Solution Approach 2:
Different participants hold different portions of the secret with varying levels of access and responsibility. The system assigns local qualities to different shares, allowing flexible recovery thresholds and access control. Not all shares require equal trust or security measures, optimizing the balance between ease of recovery and security.
3Reliability
If share distribution requires secure transmission mechanisms, then security is improved, but in-person interactions and complex mechanisms are needed reducing scalability
Solution Approach 1:
The patent replaces mechanical or in-person share distribution mechanisms with cryptographic and automated digital transmission systems. Shares can be securely transmitted through standard communication channels using encryption and verification protocols, eliminating the need for physical meetings or complex manual procedures while maintaining high security standards.
4Reliability
If guardians hold shares for recovery, then secret recovery is enabled, but guardians may misplace, lose, or become malicious reducing availability
Solution Approach 1:
The system enables participants to self-verify their share possession and status without requiring guardians or central authorities. Each participant independently manages their own share and can verify its integrity and availability, eliminating the risk of guardian misconduct, loss, or misplaced shares while maintaining full recovery capability.
Data Source
AI summary
An asynchronous system enables a secret (digital data) to be decentralized by deriving and distributing shares among a set of guardian computing systems such that the secret can be reconstructed by a consensus of the guardian computing systems. Communications between the secret owner's computing system and the guardian computing systems are subject to a communication protocol under which at least some of the messages include encryption protocol data that operates to coordinate key updates for securing subsequently transmitted messages. Additionally, the system provides mechanisms to verify possession of the shares by the guardian computing systems and potentially redistribute the shares.