Secret Sharing Management System for Secure Key Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for securely sharing secrets between computing devices in a network face vulnerabilities due to the lack of mechanisms for verifying the authenticity of public keys and ensuring the source of encrypted secrets, leading to potential unauthorized access and malicious exploitation of resources.
Innovation Solution
A secret sharing management (SSM) system is implemented to control access to private keys, using a secret sharing management system that receives unsigned digital certificates, signs them, and stores them in a shared data storage, allowing decentralized secret transfer without exposing private keys to client devices, thereby ensuring secure encryption and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key cryptography is used for secret sharing between computing devices, then security is improved, but the risk of unauthorized access increases due to lack of certificate verification
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary that issues digital certificates to verify the authenticity of public keys. The CA acts as a trusted mediator between communicating devices, providing certificate verification mechanisms that prevent unauthorized access while maintaining the security benefits of public key cryptography.
Solution Approach 2:
The patent implements preliminary certificate verification before secret sharing operations. Digital certificates are obtained and verified in advance to authenticate public keys, ensuring that only authorized devices can participate in secret sharing. This preliminary authentication prevents unauthorized access before it can occur.
2Reliability
If decentralized secret transfer is implemented without central secret storage, then security is improved, but the ability to verify source authenticity deteriorates
Solution Approach 1:
The patent uses digital certificates as intermediary verification mechanisms that travel with encrypted secrets in decentralized transfers. These certificates provide source authenticity information without requiring centralized storage, allowing receiving devices to verify the origin of secrets while maintaining decentralization and security.
Solution Approach 2:
The patent implements copying of digital certificates along with encrypted secrets during decentralized transfer. The source device's identity information is copied into the certificate, which is then transmitted with the secret. This allows the receiving device to verify the source authenticity of the transferred secret without centralized storage.
3Reliability
If private keys are made inaccessible to client devices, then security is improved, but the complexity of key management increases
Solution Approach 1:
The patent extracts private key management from client devices and concentrates it in dedicated key management servers. Private keys are generated and stored securely on these specialized servers, while client devices only handle public keys and encrypted data. This separation maintains high security while reducing client device complexity.
Solution Approach 2:
The patent introduces key management servers as intermediaries between clients and private keys. These servers act as trusted mediators that handle private key operations (signing, decryption) on behalf of clients, allowing clients to maintain security by never possessing private keys while keeping key management relatively simple through standardized API interactions.
Data Source
AI summary
A system and method of signing messages using public key cryptography and certificate verification. The method includes generating a digital certificate based on a signed request. The method includes causing the digital certificate to be stored in a shared data storage available to a first client device. The method includes signing a message using a first private key associated with the first client device to generate a signed message. The first private key is inaccessible to the first client device.