Cryptographic Seed Envelope for Secure Last Secret Generation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for securely storing and sharing cryptographic keys and passwords are inconvenient and vulnerable to unauthorized access, as they often require human operators to manually provide components or use physical media that can be stolen and used to regenerate keys.

Innovation Solution

A system and method where a cryptographic module on one network node generates a seed to derive a last secret, creates an envelope around it, and transmits it to a computing system on a different node, which decrypts the envelope to recover the seed and obtain the last secret, ensuring that neither node can derive the secret independently, thus maintaining confidentiality and integrity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Duration of action of stationary object

If the cryptographic key and password are saved to a non-volatile medium for survival after system restart, then the cryptographic key and password can be recovered after restart, but the system becomes vulnerable to unauthorized access if the medium is stolen

Engineering Contradiction:

Improvepersistence of cryptographic key and passwordVSAvoidvulnerability to theft and unauthorized access

Core Design Contradiction:

Duration of action of stationary objectVSObject-affected harmful factors

Solution Approach 1:

The cryptographic key is segmented into multiple components that are distributed across different storage locations (volatile and non-volatile memory). The password is separated from the key components and stored differently. This segmentation ensures that no single stolen component can regenerate the full cryptographic key, resolving the vulnerability while maintaining persistence through distributed storage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A secure enclave or trusted execution environment acts as an intermediary between the stored password and the cryptographic key regeneration process. The enclave securely holds the password and controls its usage, mediating the interaction between persistent storage and key generation. This prevents direct access to the password even if other components are stolen, while still enabling key regeneration when needed.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If human operators provide components simultaneously to regenerate the cryptographic key, then the key can be regenerated, but the process becomes inconvenient and requires coordination

Engineering Contradiction:

Improveability to regenerate cryptographic keyVSAvoidconvenience of key regeneration process

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system implements self-service key regeneration by automatically collecting the necessary components (key components from secure storage and password from the user) and regenerating the cryptographic key without requiring manual coordination between multiple operators. The secure enclave automatically manages the regeneration process, eliminating the inconvenience of simultaneous provision while maintaining security through controlled access.

Inventive Principle:

Principle #25Self-service

3Reliability

If the password is stored with the cryptographic key components, then the complete system can be recovered, but unauthorized parties can access both and regenerate the key

Engineering Contradiction:

Improvecompleteness of cryptographic system recoveryVSAvoidrisk of unauthorized key regeneration

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The cryptographic system is segmented into distinct components: key components stored in secure volatile memory, password stored separately in secure non-volatile memory or obtained from the user, and a secure enclave that coordinates their usage. This segmentation ensures that even if one component is compromised, the others remain protected, maintaining both completeness of recovery and security against unauthorized access.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secure enclave acts as an intermediary that controls access between the password and key components. It verifies the password and then uses it to regenerate the cryptographic key only under authorized conditions. This mediation prevents unauthorized parties from combining stolen components while ensuring reliable system recovery when proper authentication occurs.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11997201B2Systems and methods for generation of the last obfuscated secret using a seed

Publication Date: 2024.05.28 WELLS FARGO BANK NA

AI summary

Systems and methods for securely sharing and authenticating a last secret can include generating, by a cryptographic module on a first network node, a seed configured for deriving or recovering a last secret, the last secret providing access to a secure entity and being a last cryptographic element controlling access to the secure entity, creating, by the cryptographic module, an envelope for the seed, enveloping the seed by the envelope, and transmitting, by the cryptographic module, the seed to a computing system on a second node different than the first node, the computing system being configured to decrypt the envelope of the enveloped seed to recover the seed, and obtain the last secret based on the seed, where the cryptographic module is prevented from deriving the last secret.