Trust Engine for Secure Cryptographic Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic systems lack secure key management and authentication mechanisms, leading to potential breaches in user data and agreement repudiation, especially in distributed and networked environments.
Innovation Solution
A cryptographic system with a trust engine that securely stores and manages cryptographic keys and user authentication data, using asymmetric key pairs and data splitting techniques to ensure secure data sharing and access, while maintaining user independence and portability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic keys are stored in distributed environments, then data sharing accessibility is improved, but security and key management control deteriorate
Solution Approach 1:
A trust engine is introduced as an intermediary component that mediates between distributed storage locations and users. The trust engine securely stores cryptographic keys and authentication data, performing cryptographic operations on behalf of users without exposing private keys. This resolves the contradiction by enabling distributed data sharing while maintaining centralized secure key management through the trust engine's mediating role.
2Reliability
If asymmetric key pairs are used for secure encryption, then data security is improved, but computational overhead and system complexity increase
Solution Approach 1:
The trust engine merges multiple cryptographic functions into a single integrated component. It combines asymmetric key management, symmetric key generation, data splitting, and authentication mechanisms into one unified system. This reduces overall system complexity by eliminating the need for separate key management systems while maintaining strong asymmetric key-based security through the integrated trust engine.
3Reliability
If data is split into multiple shares and stored separately, then security against single-point breaches is improved, but data access complexity increases
Solution Approach 1:
Data is segmented into multiple separate shares using secret sharing schemes, with each share stored in different locations. The trust engine manages the segmentation process and coordinates the reassembly of shares when data access is required. This resolves the contradiction by providing breach resistance through segmentation while the trust engine simplifies the access process by automatically coordinating share collection and reconstruction.
4Reliability
If private keys are kept within the trust engine, then key security is improved, but user independence and portability deteriorate
Solution Approach 1:
The trust engine provides self-service cryptographic operations to users without requiring them to directly manage private keys. Users can authenticate and perform cryptographic operations through the trust engine's interfaces, which handle key management internally. This resolves the contradiction by maintaining secure private key storage within the trust engine while providing users with independent access to cryptographic functions through the engine's service interfaces.
Data Source
AI summary
Systems and methods are provided for securely sharing data. A processor forms two or more shares of a data set encrypted with a symmetric key, the data set associated with a first user device, and causes the encrypted data set shares to be stored separately from each other in at least one remote storage location. The processor generates first and second encrypted keys by encrypting data indicative of the symmetric key with a first asymmetric key of first and second asymmetric key pairs associated with the first user device and a second user device, respectively, and causes the encrypted key to be stored in the at least one storage location. To restore the data set, a predetermined number of the two or more encrypted data set shares and at least one of the second asymmetric keys of the first and second asymmetric key pairs are needed.