Distributed Vault Key Share Expiration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Centralized data storage platforms face challenges in managing data accessibility and security, particularly in ensuring that data is only available for a specified period and can be revoked on demand, while maintaining the integrity of encrypted content across a distributed ledger system.

Innovation Solution

The solution involves encrypting content with a key, splitting it into key shares using a threshold secret sharing scheme, and distributing these shares among nodes of a distributed vault, where each share is assigned an expiry value, ensuring that only authorized nodes and users can reconstruct the encryption key, thus controlling data availability and security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data is stored on a distributed ledger, then data accessibility and security are improved, but data availability control and expiration capability deteriorate

Engineering Contradiction:

Improvedata securityVSAvoiddata availability control

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The encryption key is divided into multiple key shares using threshold secret sharing. Each key share is distributed to different nodes with individual expiration times. This segmentation allows the system to maintain data security through distributed key management while enabling precise control over data availability duration through selective key share expiration.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system implements dynamic key share expiration where each key share has a configurable expiration time. Nodes automatically delete expired key shares, enabling the system to transition from static permanent storage to dynamic time-limited access control, thus resolving the contradiction between security and availability control.

Inventive Principle:

Principle #15Dynamics

2Reliability

If key shares are distributed among multiple nodes, then security against single point of failure is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Nodes automatically manage their own key shares by deleting expired shares without requiring manual intervention. The system self-regulates security through automatic expiration enforcement, reducing operational complexity while maintaining distributed security benefits.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Expiration times are pre-configured for each key share before distribution. Nodes store and enforce these pre-set expiration times automatically, eliminating the need for complex real-time authorization systems and reducing operational complexity while maintaining security.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11856092B2Limiting data availability on distributed ledger

Publication Date: 2023.12.26 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An example operation may include one or more of encrypting content via an encryption key to generate encrypted content, storing the encrypted content via a distributed ledger, splitting the encrypted encryption key into a set of key shares via a threshold secret sharing scheme, and distributing the set of key shares among a plurality of nodes of a distributed vault, where each key share is distributed with an expiry value that identifies when the respective key share is to be deleted by a node.