Split Secret Key Backup for Independent Wallet Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in securely accessing digital wallets due to loss or unauthorized access to secret keys, whether stored locally or by service providers, leading to potential loss of access or security risks.
Innovation Solution
A user and service provider split a secret key into portions, with each generating a part encrypted using a verifiable encryption scheme, allowing the user to recover the key independently without relying solely on the service provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the secret key is stored locally on the user device, then the user has full access to the digital wallet, but the user may lose the secret key or have it compromised by unauthorized access
Solution Approach 1:
The secret key is divided into multiple portions (first portion and second portion) that are stored separately - one portion on the user device and another portion encrypted and stored by the service provider. This segmentation allows the user to access their wallet independently while maintaining security through distributed storage.
Solution Approach 2:
The service provider acts as an intermediary that holds an encrypted portion of the secret key without being able to decrypt it. The verifiable encryption scheme serves as a mediator that enables the user to recover their secret key from the service provider without revealing the key to the provider, thus maintaining both accessibility and security.
2Reliability
If the secret key is stored by a service provider, then security is improved and loss prevention is enhanced, but the user loses autonomy and becomes dependent on the service provider for access
Solution Approach 1:
The user maintains the ability to service their own digital wallet needs by keeping one portion of the secret key locally. The user can independently access their wallet, generate transactions, and recover their secret key from the service provider without requiring the provider's active participation or permission, thus maintaining user autonomy while benefiting from the provider's secure storage infrastructure.
Solution Approach 2:
The service provider pre-encrypts the second portion of the secret key using a verifiable encryption scheme before storing it. This preliminary action ensures that when the user needs to recover their secret key, they can do so independently by obtaining the encrypted portion from the service provider and decrypting it using their own key material, without needing the provider's further involvement.
3Reliability
If the secret key is split into portions with encrypted storage by service provider, then user autonomy and security are enhanced, but the system complexity increases
Solution Approach 1:
The system changes the parameter of encryption from standard encryption to verifiable encryption, which adds a verification capability without requiring complex key management infrastructure. This parameter change allows the service provider to store encrypted key portions that can be verified and recovered by users through a standardized process, managing complexity through well-defined cryptographic parameters.
Data Source
AI summary
Methods, systems, and devices for data management are described. Techniques described herein may enable a user and a service provider to each obtain a portion of a secret key. For example, the user may generate a user portion of the secret key, encrypt the user portion of the secret key using a public encryption key, and transmit the encryption of the user portion of the secret key to the service provider. The service provider may generate a service provider portion of the secret key, encrypt the service provider portion, and transmit the encryption of the service provider portion of the secret key to the user. The user may recover the user portion of the secret key by retrieving the encryption of the user portion of the secret key from the service provider, or may generate the full secret key by decrypting the service provider portion of the secret key.