Security Key Fragmentation and Storage Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for storing private and public encryption keys in data processing systems are vulnerable to key identification and extraction, particularly in JavaKeyStore, due to the unique binary patterns of private keys, making them susceptible to unauthorized access and impersonation threats.
Innovation Solution
The method involves fragmenting security keys and certificates into non-uniform length fragments using a predetermined algorithm, intermixing them within a storage means, and using a passcode to determine storage locations, with a bit map to record fragment locations, thereby obscuring the identifying pattern and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored in a local file store with strong protection, then security is improved, but the unique binary patterns of private keys make them identifiable and extractable by attackers
Solution Approach 1:
The patent divides private keys into multiple fragments and stores them separately within the file store. Each fragment alone is useless for cryptographic operations, and the fragments are distributed across different locations. This segmentation prevents attackers from easily identifying and extracting complete keys, as they would need to locate and reconstruct all fragments in the correct sequence.
Solution Approach 2:
The patent applies different storage strategies to different parts of the key material. Instead of storing the complete key as a single entity with uniform protection, the key is broken into fragments that can be stored with different characteristics. Some fragments may be stored in encrypted form, others in different locations, with varying access controls, making uniform attack patterns ineffective.
2Ease of operation
If keys are stored in a simple format for easy retrieval, then ease of operation is improved, but security is worsened due to identifiable patterns
Solution Approach 1:
The patent performs preliminary fragmentation and encoding of keys before storage. The key material is pre-processed into fragments with embedded identification information that enables automated retrieval. When a key is needed, the system can quickly locate the fragments using pre-established indexing mechanisms, then automatically reconstruct them in the correct sequence, providing both security and ease of operation.
Solution Approach 2:
The patent introduces an intermediary fragmentation and reconstruction mechanism between the key and its storage location. This intermediary process transforms the key into a form that is secure during storage but can be easily retrieved and reconstructed when needed. The fragmentation scheme acts as a mediator that balances security requirements with operational efficiency.
Data Source
AI summary
A method and apparatus for storage of security keys and certificates is provided in which the keys and certificates are fragmented into non-uniform lengths and stored in a data file (110). The fragments (152, 154) of the keys and certificates are intermixed within the data file (110). The fragmentation is carried out according to an algorithm (200) which may be based on a pass phrase (140) to the data file (110). The position of storage of each fragment (152, 154) within the data file (110) is also determined by the algorithm (200).