Secure Self Managed Data Encryption Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security methods require significant infrastructure investment and are not effectively self-managing, making it difficult to ensure secure storage and access control for sensitive data across various environments.
Innovation Solution
A system utilizing a master key encryption method where the master key is split into multiple pieces and stored securely across different sites, with a unique ID and classification level used to create a self-managed data (SSMD) key for encoding and decoding data, allowing secure data storage even on unsecure sites through AES encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional data security methods are used, then data security is improved, but infrastructure investment and complexity increase
Solution Approach 1:
The master key is divided into multiple separate pieces stored at different locations (key site, configuration file, database). This segmentation allows the system to achieve strong security without requiring a single complex centralized infrastructure, as each piece can be stored using simple, distributed storage mechanisms.
Solution Approach 2:
The encryption scheme uses nested encryption where data is encrypted with a data encryption key, which is then encrypted with the master key. The master key itself is segmented and stored separately. This nested structure provides strong security while keeping each individual component simple and manageable.
2Adaptability or versatility
If data is stored on unsecure sites, then storage flexibility is improved, but security risk increases
Solution Approach 1:
By segmenting the master key into multiple pieces distributed across different storage locations, the system enables data to be stored on less secure sites while maintaining security. Even if one storage location is compromised, the remaining key pieces maintain security through the threshold requirement.
Solution Approach 2:
The segmented key pieces act as intermediaries between the data and the encryption mechanism. These distributed key fragments serve as a mediator that provides security without requiring the data itself to be stored on secure infrastructure, allowing flexibility in storage location while maintaining protection.
3Reliability
If master key is stored in multiple locations, then security against subsystem compromises is improved, but key management complexity increases
Solution Approach 1:
The master key is segmented into multiple pieces that can be independently stored and managed at different locations. This segmentation provides security through distribution while keeping each individual key piece simple to manage, as each piece is a discrete unit that can be handled independently.
Solution Approach 2:
The key pieces are pre-assembled and stored in their final form at multiple locations before use. This preliminary preparation eliminates the need for complex runtime key assembly operations, simplifying key management while maintaining the security benefits of distributed storage.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach provides robust security against brute force attacks and subsystem compromises, enabling secure data storage and access control without the need for extensive infrastructure, ensuring data secrecy and compliance with security regulations.
Implementation Method 1
SSMD encrypts the data using the above key, using AES crypto algorithm, or a similar strong crypto algorithm
Implementation Method 2
SSMD creates a unique data encryption key as master application key+unique ID; specifically, the unique ID may be XOR'd to the low significant bits of the master application key
Data Source
AI summary
A system, according to one embodiment, includes a master key for encryption of data; an encryption key site accessible by computer and storing a first piece of the master key; a configuration file resident in a computer file system, the configuration file storing a second piece of the master key; a computer database storing a third piece of the master key; a master-key seal key used to encrypt the master key, wherein a secure self managed data (SSMD) key is obtained by assembling and decrypting the first piece, the second piece and the third piece using the master-key seal key; a unique ID for the data; a classification level for the data; and an expiration time for the data, wherein the data, the unique ID, the classification level, and the expiration time are encrypted together using the SSMD key to form an SSMD encoded data.