Secure Token Key Recovery via Intermediary Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token security systems fail to securely recover a key from an archive and transfer it to a token without compromising security, as they do not allow key extraction or transportation while maintaining authorization.
Innovation Solution
A method and system that generate a key transport session key, derive a key encryption key from a server master key and token identification, encrypt and decrypt keys securely to recover and enroll a private key onto the token, ensuring only authorized access and secure key transport.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a key is archived in storage separate from the token for security, then security is improved, but key recovery becomes difficult when the token is lost or broken
Solution Approach 1:
The patent introduces a key encryption key (KEK) as an intermediary that enables secure key recovery. The KEK is derived from a server master key and token identification, allowing the archived private key to be decrypted and transferred to a replacement token without compromising the security of the archived key storage. This mediator resolves the contradiction by enabling recovery while maintaining security isolation.
Solution Approach 2:
The system performs preliminary actions by archiving the private key in encrypted form with the storage session key, and pre-establishing the key encryption key derivation mechanism based on server master key and token identification. When token recovery is needed, these preliminary preparations enable secure key retrieval without requiring the original token, thus resolving the recovery difficulty while maintaining security.
2Reliability
If security protocols are maintained during key transport, then security is improved, but the complexity of key management increases
Solution Approach 1:
The patent segments the key management process into distinct phases with dedicated keys: storage session key for archiving, key encryption key for transport, and key transport session key for final delivery. This segmentation allows each phase to have optimized security measures without affecting other phases, reducing overall management complexity while maintaining security.
Solution Approach 2:
The system changes cryptographic parameters dynamically based on the operation phase. The key encryption key is derived from server master key and token identification, while the key transport session key is generated specifically for the transport operation. This parameter changes approach enables flexible key management that adapts to different security requirements of each phase without increasing complexity.
Data Source
AI summary
Methods, systems and computer readable mediums are provided for recovering keys. A key transport session key is generated, and a key encryption key is derived based on a server master key and an identification associated with a token. The key transport session key is encrypted with the key encryption key as a first wrapped key transport session key. An encrypted storage session key and an encrypted private key are retrieved from an archive. The encrypted storage session key is decrypted with a server storage key as a storage session key. The encrypted private key is decrypted with the storage session key. The decrypted private key is encrypted with the key transport session key as a wrapped private key. The wrapped private key and the first wrapped key transport session key are forwarded.