Secret-Sharing Storage With Two-Path Key Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in ensuring data confidentiality by requiring encryption keys to be stored at user locations, which increases vulnerability to attacks and burdens the user with key management.
Innovation Solution
A secret sharing-based storage system employs two-path communication between user locations and cloud servers, using separate paths for encrypted data and encryption keys, eliminating the need for storing encryption keys at user locations by distributing and decrypting data across multiple cloud servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored at user locations to ensure data confidentiality, then data security is improved, but user burden and vulnerability to attacks increase
Solution Approach 1:
The encryption key is segmented into multiple key shares using secret sharing schemes. Each key share is distributed to different cloud servers rather than being stored完整地 at the user location. This segmentation allows the user to avoid storing the complete key while maintaining security through distributed key management.
Solution Approach 2:
Cloud servers act as intermediaries in the key management process. Instead of the user directly storing and managing encryption keys, the system uses cloud-based secret sharing locations as intermediaries to hold key shares and facilitate key recovery when needed.
2Reliability
If encryption is executed at user locations to prevent plain text theft, then data confidentiality is improved, but the system complexity and key management burden increase
Solution Approach 1:
The key management functionality is extracted from the user's local system and relocated to cloud-based secret sharing locations. This extraction eliminates the need for users to directly manage encryption keys locally, reducing system complexity while maintaining confidentiality through distributed key storage.
Solution Approach 2:
The system enables automated key management through self-service mechanisms where cloud servers automatically handle key share distribution and reconstruction. This eliminates manual key management operations for users, reducing complexity while maintaining security through automated cryptographic processes.
3Reliability
If multiple encryption layers are applied to protect data in transit and at rest, then data security is improved, but processing time and computational overhead increase
Solution Approach 1:
Encryption is performed preliminarily at the user location before data is uploaded to cloud servers. This preliminary encryption action ensures that data is protected before leaving the user's control, allowing for efficient subsequent processing at cloud servers without requiring additional encryption layers during storage and transmission.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
According to one embodiment, a secret sharing-based storage system (1) includes N cloud servers (30) and a secret sharing device (20). The secret sharing device (20) receives second data obtained by encrypt first data using an encryption key from a user terminal (10), generates N distributed data by executing distribution processing on the second data, and stores the N distributed data separately in N cloud servers. The system (1) executes two-path communication between the user terminal and each of the N cloud servers. The first path is for sending second data from the user terminal to the secret sharing device and for sending the distributed data from the secret sharing device to the cloud server. The second path is for sending the encryption key from the user terminal to the cloud server.