Split-key cryptography for multi-device data synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for mobile devices face challenges in protecting sensitive data across multiple devices while maintaining usability and security, as they often require complex key management and authentication processes that can be distracting and vulnerable to unauthorized access.
Innovation Solution
The implementation of split-key based cryptography techniques that encrypt data using a randomly-generated key, split into shares stored across devices and a server, allowing secure reconstruction of the key for access, with optional offline and online modes, and a recovery mechanism using user-defined shares and authentication methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are used to protect sensitive data, then security is improved, but key management complexity and user involvement increase
Solution Approach 1:
The cryptographic key is divided into multiple shares using secret sharing schemes. Each share is stored on different devices or locations, and a threshold number of shares are required to reconstruct the original key. This segmentation eliminates the need for centralized key management while maintaining security, as no single point of failure exists.
Solution Approach 2:
A trusted third party or secure enclave acts as an intermediary to facilitate key reconstruction when needed. This intermediary coordinates the combination of key shares without permanently storing the complete key, reducing management complexity while enabling secure access when required.
2Reliability
If keys are protected using password-protected credentials, then security is improved, but usability deteriorates due to authentication requirements
Solution Approach 1:
The authentication process is segmented into multiple factors distributed across different devices. Instead of requiring a single password, the system uses distributed key shares that can be combined through various authentication methods including biometrics, device unlock patterns, or possession of specific devices, improving usability while maintaining security.
Solution Approach 2:
The system enables self-service authentication where users can unlock their own data using their device's existing authentication mechanisms (fingerprint, face recognition, device passcode) without requiring separate key management credentials. The key shares are automatically combined when authentication succeeds.
3Adaptability or versatility
If data is synchronized across multiple devices, then accessibility is improved, but security vulnerabilities increase due to multiple access points
Solution Approach 1:
The complete cryptographic key is segmented into multiple shares distributed across different devices and locations. Each device holds only a portion of the key, making it impossible to access data if a single device is compromised. Data can be accessed on multiple devices by combining the required number of key shares, maintaining accessibility while reducing security vulnerabilities.
Data Source
AI summary
Split-key based cryptography techniques are provided for data protection and synchronization across multiple computing devices of a user. A method performed by a first device of a user comprises encrypting a data using a randomly-generated data encryption key; wrapping the data encryption key with a public key of a second device of the user; and sending the encrypted data and the wrapped data encryption key of the first device wrapped with the public key of the second device to a server. The server sends the encrypted data and the wrapped data encryption key of the first device wrapped with the public key of the second device to the second device. The first device or the second device can access the encrypted data by reconstructing their respective private key using a predefined number of shares obtained using a key splitting scheme.