Secure Data Parsing with Split-Key Storage for Mobile Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems rely heavily on user security, which is vulnerable to breaches due to user negligence or malicious attacks, and mobile biometric systems face risks of loss or theft of devices containing private keys, leading to compromised data access.
Innovation Solution
A cryptographic system with a server-centric trust engine that stores cryptographic keys and authentication data, allowing users to access cryptographic functions remotely without releasing actual keys, and employs data splitting and storage across multiple geographically remote locations to ensure security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored on user devices for mobile access, then user convenience and mobility are improved, but security is worsened due to device loss or theft
Solution Approach 1:
The cryptographic key is divided into multiple segments or shares using secret sharing schemes. Each segment is stored in different locations or on different devices. No single device contains the complete key, so even if one device is lost or stolen, the key cannot be reconstructed without combining multiple segments from authorized sources.
Solution Approach 2:
A trusted server or intermediary system is introduced to manage and distribute key segments. The server acts as a mediator that can reconstruct and provide key segments when needed, but does not store the complete key itself. This intermediary enables mobile access while maintaining security by controlling key availability without requiring full key storage on user devices.
2Ease of operation
If private keys are stored in accessible files on hard drives, then ease of access is improved, but security is worsened due to susceptibility to brute-force attacks
Solution Approach 1:
The private key is segmented into multiple parts that are distributed across different secure storage locations. Instead of storing the complete key in a single accessible file, each segment is stored separately with restricted access. This segmentation prevents brute-force attacks on the complete key while still allowing authorized access through controlled reconstruction of segments.
Solution Approach 2:
Different segments of the key are stored with different security characteristics in different locations. Some segments may be stored with higher security measures (e.g., encrypted, access-controlled) while others have different protection levels. This local quality variation optimizes both security and accessibility for different key portions.
3Reliability
If key backup and archiving systems are implemented, then data availability is improved, but security is worsened due to key migration through multiple systems
Solution Approach 1:
The key backup system stores segmented portions of the cryptographic key across multiple archive systems rather than complete key copies. Each archiving system holds only a portion that is useless alone. This segmentation maintains data availability through distributed backup while preventing key migration security breaches since no single system can reconstruct the complete key.
Solution Approach 2:
A centralized key management service or intermediary system coordinates the backup and recovery process. Instead of allowing direct key migration between multiple archiving systems, the intermediary mediates all key access and reconstruction operations, ensuring that key segments are combined only through authorized channels under controlled security protocols.
Data Source
AI summary
A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.