Session-Bound Cryptographic Key Management Without Client Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key management systems expose decryption keys to clients, leading to potential unauthorized decryption and user tracking, as they are often long-lived, shared among multiple systems, and stored outside secure networks.
Innovation Solution
An authorization server generates ephemeral, time-bound encryption keys per user session, embedding them into access tokens, and provides access token handles to clients, ensuring keys are only shared within secure networks and are distinct per user and session, preventing unauthorized access and tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If decryption keys are stored or exposed to the client for data protection, then data can be decrypted when needed, but the keys become accessible to unauthorized parties and attackers
Solution Approach 1:
The patent extracts the decryption key from the client environment and keeps it exclusively on the server side. The access token contains only an encrypted version of the key, while the decryption key itself remains on the authorization server, eliminating client-side key exposure risks while maintaining decryption capability.
Solution Approach 2:
The patent introduces an encrypted access token as an intermediary between the client and the decryption key. The access token contains the encrypted key and can be transmitted to the client, but the actual decryption key remains on the server, using the encrypted token as a safe mediator for key distribution.
2Ease of operation
If decryption keys are long-lived and shared among multiple systems for ease of use, then key management is simplified, but user tracking and unauthorized decryption become possible
Solution Approach 1:
The patent segments the decryption key into session-specific instances. Each user session receives a unique encrypted access token with its own encrypted key version, derived from session-specific data. This segmentation prevents cross-session key reuse and eliminates user tracking while maintaining operational simplicity through automated token management.
Solution Approach 2:
The patent makes the decryption key dynamic by regenerating it for each user session. The key is derived from session-specific information (user ID, timestamp, random data) and automatically expires when the session ends. This dynamic approach replaces static long-lived keys with ephemeral session keys, preventing unauthorized decryption across sessions.
3Adaptability or versatility
If decryption keys are shared among multiple systems for functionality, then system integration is improved, but the risk of key exposure and unauthorized access increases
Solution Approach 1:
The patent applies local quality by giving each system or service its own specific encrypted access token with a key encrypted for that particular system. Instead of sharing a universal decryption key, each integrated system receives a customized encrypted token, maintaining system integration capability while restricting key access to specific authorized systems only.
Data Source
AI summary
An authorization server, method, and non-transitory computer readable medium for generating and managing at least one access token associated with a client. The authorization server may include a memory configured to store computer readable instructions; and processing circuitry configured to execute the computer readable instructions to cause the authorization server to, compute an encryption key based on information associated with a user session, embed the encryption key into the at least one access token, map, within a database, the at least one access token to an access token handle associated with the client, return the access token handle to the client, and selectively provide the access token to at least one web Application Programming Interface (API) in response to receipt of the access token handle from the at least one web API.