Google Patentsopen access

Storing and determining a data element — Sebastien ARMLEDER (US12101400B2)

ABSTRACT

Abstract

A method comprises generating, based on a data element, M data element shares, wherein M is an integer greater than 1; providing each of M encryption keys to a first data processing unit; the first data processing unit encrypting each of the M data element shares with an encryption key, respectively, and thus generating M encrypted data element shares, wherein each of the encryption keys corresponds to a decryption key, respectively.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No. 17/162,265, filed Jan. 29, 2021, which claims the benefit of European Application No. 20154430.1, filed Jan. 29, 2020, in the European Patent Office, each of which is incorporated herein by reference.

The present invention relates to storing and determining data.

As information is becoming more and more electronically accessible, an important task is storing sensible data in a secure manner. Typically, this is achieved through encryption techniques. Through encryption, information can be encoded in such a way that the intelligibility of the data is removed. Thus, even if the encrypted data are accessed by a third party, the original information cannot be recovered unless the data is decrypted.

Data is typically encrypted using an encryption algorithm, referred to as a cipher. The cipher uses an encryption key for encrypting the data. The encryption key is typically pseudo-random. The cipher and the encryption key are implemented such that, in principle, it is not possible to decrypt the message without possessing the decryption key. That is, a well-designed encryption algorithm and a properly generated encryption scheme makes it computationally infeasible to recover the data without access to the decryption key. However, an authorized user (i.e. the user comprising the decryption key) can easily in a computationally feasible manner decrypt the data to recover the original information.

Although there are many algorithm schemes developed, they generally belong to either of the two categories: symmetric encryption and asymmetric encryption.

In a symmetric encryption scheme, the encryption and decryption key are the same. That is, the same key is used both for decryption and decryption. They are also referred to as symmetric-key encryption schemes. Some examples of symmetric encryption schemes are: Blowfish designed by Bruce Schneier, Advanced Encryption Standard (AES) designed by Vincent Rijmen and Joan Daemen, Rivest Cipher 4/5/6 (RC4/5/6) designed by Ron Rivest, Data Encryption Standard (DES) designed by IBM. The most commonly used symmetric algorithm is AES with key lengths 128, 192 or 256 bits.

On the other hand, in an asymmetric encryption scheme, the encryption and decryption keys are not the same. More particularly, the asymmetric encryption scheme involves the generation of a key pair such that if data is encrypted with one of the keys, the other key from the pair can be used to decrypt it and vice versa. Typically, the key pairs are referred to as public key and private key, and the encryption scheme is also referred to as public-encryption scheme. As the name suggests, the public key can be made public (i.e. anyone can have access to it) without impinging the security of the encryption scheme. However, the private key must be kept secret (i.e. stored securely). Typically, data can be encrypted with the public key and can be decrypted only by the private key. As such, anyone can encrypt data using the public key of a user such that only that user (possessing the corresponding private key) can decrypt the data. Furthermore, the public and private key pair are generated such that knowledge on the one does not provide any knowledge on the other key. That is, having one of the keys (e.g. the public key), it is not computationally feasible to determine what the other key is (e.g. the private key). This further ensures that the private key is kept secret even though the public key can be me published. Popular asymmetric encryption schemes are Rivest-Shamir-Adleman (RSA) scheme designed by Ron Rivest, Adi Shamir and Leonard Adleman and Elliptic Curve Cryptography (ECC) designed by Neal Koblitz and Victor S. Miller independently. Asymmetric encryption schemes are mostly used by typical communications carried over unsecured channels (e.g. over the Internet).

Encryption schemes not only provide a secure way of storing and communicating data, but they also form the basis of many other algorithms that allow further tasks to be carried out electronically. One of such functionalities is the ability to electronically sign data. This is performed through digital signatures which can be attached to data. The digital signature allows a recipient of the data to verify the identity of the sender of the data as well as whether the data was altered in transit from sender to recipient. Digital signature algorithms are typically based on asymmetric encryption schemes. A variant of digital signature algorithms based on elliptic curve cryptography is the Elliptic Curve Digital Signature Algorithm (ECDSA).

A further functionality offered through the use of encryption schemes is the electronical proof of identity. This is generally performed through the use of digital certificates issued by a certificate authority. A certificate authority is a trusted entity that issues digital certificates. The holder of a digital certificate can use it to prove its identity. An example of digital certificates is a public key certificate (PKC). PKC proves the ownership of a public key by including information about the public key, information about the identity of the owner and the digital signature of an entity that has verified the certificate's contents (i.e. the certificate authority). The most common format for public key certificates is defined by X.509 standard.

Although encryption schemes are a powerful tool for securely storing and communication information, they require to securely store of at least one key. That is, in case of symmetric encryption, the encryption/decryption key must be kept private and in the case of asymmetric encryption schemes the private key must be securely stored. However, securing such a key can be a challenge as it needs to be ensured that the key can only be accessed by authorized users and that the key is not lost.

Securing keys is a particular problem in blockchain-based technologies. With the appearance of blockchain technologies, asymmetric cryptography has been applied to securing the possession of valuable assets. As an example, the detention of a private key on the Bitcoin blockchain (Elliptic Curve Cryptography based-curve P256k1) provides control (and therefore ownership) to all the bitcoins associated with this private key. The valuable assets can sometimes represent a huge economic value. The rights on these assets is exercised by performing a digital signature, typically Elliptic Curve Cryptographic Digital Signature Algorithm (ECDSA) with the corresponding private key on an intended transaction. The transaction and its digital signature are then broadcast on the corresponding network for validation and inclusion in an immutable block.

Holding such assets represents two problems. On the one hand, in case of loss or destruction of the private key, there is no possibility for recovery and as such the assets become unusable. On the other hand, in case of just a simple visualization of the private key, a thief can transfer and sell for their benefit all the crypto assets. Entities, especially big financial institutions, need to have a solution for these two problems.

The present invention addresses these needs. That is, it is an object of the present invention to provide a technology allowing data to be stored in such manner that allows its recovery, while making it difficult for third parties to obtain knowledge of the data. These objects are met by the present technology.

A first aspect of the present invention relates to a method which can be used for storing a data element. More particularly, in a first aspect, the present invention relates to a method which can be used to securely backup a data element. The method can also be referred to as a backup method, backup process or initialization phase.

The method, according to the first aspect of the preset invention, comprises generating M data element shares based on a data element. M is an integer greater than 1. That is, based on the data element, a plurality of data element shares can be generated.

Further, the method comprises a first data processing unit encrypting each of the M data element shares with an encryption key, respectively. That is, M encryption keys can be provided and each of the M encryption keys can be used to encrypt a respective data element share. Thus, M encrypted data element shares can be generated. Again, each of the M encrypted data element shares can be generated by encrypting a data element share with a respective encryption key.

Each encryption key corresponds to a decryption key, respectively. That is, a one-to-one mapping may exist between the M encryption keys and M decryption keys. An encryption key and the corresponding decryption key can form a key pair. Data encrypted by the encryption key can be decrypted by the decryption key corresponding to the encryption key. That is, if data encrypted by an encryption key can be decrypted using a decryption key then the encryption key and the decryption key correspond to each other.

Further, the method can comprise the first data processing unit outputting the M encrypted data element shares. As discussed, the M encrypted data element shares correspond to data element shares in an encrypted state. As such, the M encrypted data element shares can be output without compromising the security of the data element.

Thus, instead of simply encrypting and storing secret data, as is typical for prior art techniques, the present invention generates a plurality of shares of the secrets, encrypts each share with a respective encryption key and outputs the encrypted data element share. This can allow for the responsibility of maintaining the secrecy of a data element to be shared.

For example, M users can be selected for holding a data element share. The M users can, for example, be co-owners of the data element. For example, the data element may relate to valuable assets (e.g. cryptocurrency assets, or private key(s) corresponding to cryptocurrencies). Each user may comprise (or generate) a cryptographic identity, that is, an encryption key and a corresponding decryption key. In other words, each of the M encryption keys with the corresponding decryption key can correspond to (i.e. can be owned by) a user. Further, each user can be provided with the encrypted data element share that was generated using the user's encryption key. As such, each user can store its corresponding encrypted data element share or at least the respective decryption keys for decrypting each encrypted data element share provided that the encrypted data element share is stored on a memory component, e.g., in a database. Put simply, each user can be responsible for maintaining the secrecy of only one respective data element share of the data element. Thus, the method of the present invention can be particularly advantageous for storing data related to assets co-owned by multiple users. A person skilled in the art will understand that the user of the above example can comprise one or more user devices that can be configured to comprise or generate a cryptographic identity, storing an encrypted data element share, storing an encrypting key and storing a corresponding decryption key. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card).

Furthermore, the method can be advantageous for increasing robustness against losing the data element, e.g., by generating redundant shares. Typically, prior art techniques increase robustness by storing multiple copies of the data to be kept secret. However, this sacrifices security. The more copies of secret data are stored, the higher the likelihood of one of the copies being stolen. The present technology increases robustness against losing the data element without sacrificing security. For example, as will be discussed in the following, the redundant data element shares can be generated, such that, even if losing one or more data element shares, the data element can still be recovered.

In addition, the method can provide high security as the data element may never be output outside the first data processing unit. As discussed, the method comprises outputting encrypted data element shares. However, without the decryption keys, obtaining the data element shares from the encrypted data element shares is computationally unfeasible.

To further increase security, only the encryption keys can be provided to the first data processing unit. In fact, the decryption keys may not be present at all during the execution of the described method. That is, the first data processing unit and the respective memory components storing the decryption keys may be physically separated, i.e., in remote locations relative to each other. Alternatively or additionally, the respective memory components storing the decryption keys may be offline, i.e., any communication with a device external to said memory components may be blocked by hardware (e.g. a switch) and/or software. Alternatively or additionally, the respective memory components may store the respective decryption keys in a secure manner (e.g. encrypted) and may be configured to decrypt/output the decryption keys during the method. As such, during the above method the data element may not be recovered, preferably, even by the holders of the M encryption keys (i.e. users).

Further still, the first data processing unit may comprise a tamperproof secure microcontroller, such as, a NXP SmartMX secure microcontroller family, e.g. the NXP SmartMX3 P71D321. The use of secure microcontrollers can be particularly advantageous for increasing the security of transactions (i.e. data communications) between the first data processing unit and an external device. That is, a secure microcontroller can facilitate hiding the data element even in case of malware presence. The secure microcontroller can be configured to mitigate side channel attack to discover the data element, can be sandboxed from the rest of the first data processing unit, and can be brute force resistant (e.g. self-destroys after a limited number of failed authentications).

Preferably, the first data processing unit may comprise a secure portion (which can also be referred to as secure enclave). The secure portion can provide hardware and software protection for maintaining the secrecy of the data element. The secure portion can comprise one or more secure microcontroller and one or more secure memory components. The data element and the data element shares (i.e. unencrypted data) can be processed and stored only inside the secure portion. The secure portion can further be configured to output the data element shares only in an encrypted state, i.e., the encrypted data element shares.

Further, the first data processing unit may comprise further components external to the secure portion. These can for example be, a general processor, general microcontroller, general memory devices and I/O interfaces. Said components can facilitate receiving and sending data to/from an external device. Again, outside the secure portion only encrypted data can be present.

Thus, by separating security tasks (e.g. encrypting and decrypting) from general tasks (e.g. communication protocols), the security of the data element can be increased. This, as discussed, can be performed by providing a secure portion of the first data processing unit which can comprise a secure microcontroller (e.g. NXP P71 microcontroller).

It will be noted that the data element can also be referred to as a secret and may comprise a master private key. Similarly, the data element share can also be referred to as a secret share or share and may refer to a share of the data element that is in an unencrypted state. On the other hand, the encrypted data element share can also be referred to as an encrypted secret share or encrypted share and refers to a share of the data element in an encrypted state. A first data processing unit can also be referred to as a backup device. Furthermore, the term key refers to a cryptographic key.

The data element can be determined with N unencrypted data element shares, where N is an integer greater than or equal to 1, and smaller than or equal to M. That is, the data element shares can be generated based on the data element such that at least N data element shares in an unencrypted state are required to determine the data element. In other words, the data element shares can be generated such that some of the data element shares can be redundant. This can be advantageous because it can increase robustness against the loss of decryption keys and/or data element shares. More particularly, at most M-N decryption keys can be lost and the data element can still be determined. Similarly, at most M-N encrypted data element shares can be lost and the data element can still be determined. In general, it would require M-N+1 data element shares to be lost in order t

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No. 17/162,265, filed Jan. 29, 2021, which claims the benefit of European Application No. 20154430.1, filed Jan. 29, 2020, in the European Patent Office, each of which is incorporated herein by reference.

The present invention relates to storing and determining data.

As information is becoming more and more electronically accessible, an important task is storing sensible data in a secure manner. Typically, this is achieved through encryption techniques. Through encryption, information can be encoded in such a way that the intelligibility of the data is removed. Thus, even if the encrypted data are accessed by a third party, the original information cannot be recovered unless the data is decrypted.

Data is typically encrypted using an encryption algorithm, referred to as a cipher. The cipher uses an encryption key for encrypting the data. The encryption key is typically pseudo-random. The cipher and the encryption key are implemented such that, in principle, it is not possible to decrypt the message without possessing the decryption key. That is, a well-designed encryption algorithm and a properly generated encryption scheme makes it computationally infeasible to recover the data without access to the decryption key. However, an authorized user (i.e. the user comprising the decryption key) can easily in a computationally feasible manner decrypt the data to recover the original information.

Although there are many algorithm schemes developed, they generally belong to either of the two categories: symmetric encryption and asymmetric encryption.

In a symmetric encryption scheme, the encryption and decryption key are the same. That is, the same key is used both for decryption and decryption. They are also referred to as symmetric-key encryption schemes. Some examples of symmetric encryption schemes are: Blowfish designed by Bruce Schneier, Advanced Encryption Standard (AES) designed by Vincent Rijmen and Joan Daemen, Rivest Cipher 4/5/6 (RC4/5/6) designed by Ron Rivest, Data Encryption Standard (DES) designed by IBM. The most commonly used symmetric algorithm is AES with key lengths 128, 192 or 256 bits.

On the other hand, in an asymmetric encryption scheme, the encryption and decryption keys are not the same. More particularly, the asymmetric encryption scheme involves the generation of a key pair such that if data is encrypted with one of the keys, the other key from the pair can be used to decrypt it and vice versa. Typically, the key pairs are referred to as public key and private key, and the encryption scheme is also referred to as public-encryption scheme. As the name suggests, the public key can be made public (i.e. anyone can have access to it) without impinging the security of the encryption scheme. However, the private key must be kept secret (i.e. stored securely). Typically, data can be encrypted with the public key and can be decrypted only by the private key. As such, anyone can encrypt data using the public key of a user such that only that user (possessing the corresponding private key) can decrypt the data. Furthermore, the public and private key pair are generated such that knowledge on the one does not provide any knowledge on the other key. That is, having one of the keys (e.g. the public key), it is not computationally feasible to determine what the other key is (e.g. the private key). This further ensures that the private key is kept secret even though the public key can be me published. Popular asymmetric encryption schemes are Rivest-Shamir-Adleman (RSA) scheme designed by Ron Rivest, Adi Shamir and Leonard Adleman and Elliptic Curve Cryptography (ECC) designed by Neal Koblitz and Victor S. Miller independently. Asymmetric encryption schemes are mostly used by typical communications carried over unsecured channels (e.g. over the Internet).

Encryption schemes not only provide a secure way of storing and communicating data, but they also form the basis of many other algorithms that allow further tasks to be carried out electronically. One of such functionalities is the ability to electronically sign data. This is performed through digital signatures which can be attached to data. The digital signature allows a recipient of the data to verify the identity of the sender of the data as well as whether the data was altered in transit from sender to recipient. Digital signature algorithms are typically based on asymmetric encryption schemes. A variant of digital signature algorithms based on elliptic curve cryptography is the Elliptic Curve Digital Signature Algorithm (ECDSA).

A further functionality offered through the use of encryption schemes is the electronical proof of identity. This is generally performed through the use of digital certificates issued by a certificate authority. A certificate authority is a trusted entity that issues digital certificates. The holder of a digital certificate can use it to prove its identity. An example of digital certificates is a public key certificate (PKC). PKC proves the ownership of a public key by including information about the public key, information about the identity of the owner and the digital signature of an entity that has verified the certificate's contents (i.e. the certificate authority). The most common format for public key certificates is defined by X.509 standard.

Although encryption schemes are a powerful tool for securely storing and communication information, they require to securely store of at least one key. That is, in case of symmetric encryption, the encryption/decryption key must be kept private and in the case of asymmetric encryption schemes the private key must be securely stored. However, securing such a key can be a challenge as it needs to be ensured that the key can only be accessed by authorized users and that the key is not lost.

Securing keys is a particular problem in blockchain-based technologies. With the appearance of blockchain technologies, asymmetric cryptography has been applied to securing the possession of valuable assets. As an example, the detention of a private key on the Bitcoin blockchain (Elliptic Curve Cryptography based-curve P256k1) provides control (and therefore ownership) to all the bitcoins associated with this private key. The valuable assets can sometimes represent a huge economic value. The rights on these assets is exercised by performing a digital signature, typically Elliptic Curve Cryptographic Digital Signature Algorithm (ECDSA) with the corresponding private key on an intended transaction. The transaction and its digital signature are then broadcast on the corresponding network for validation and inclusion in an immutable block.

Holding such assets represents two problems. On the one hand, in case of loss or destruction of the private key, there is no possibility for recovery and as such the assets become unusable. On the other hand, in case of just a simple visualization of the private key, a thief can transfer and sell for their benefit all the crypto assets. Entities, especially big financial institutions, need to have a solution for these two problems.

The present invention addresses these needs. That is, it is an object of the present invention to provide a technology allowing data to be stored in such manner that allows its recovery, while making it difficult for third parties to obtain knowledge of the data. These objects are met by the present technology.

A first aspect of the present invention relates to a method which can be used for storing a data element. More particularly, in a first aspect, the present invention relates to a method which can be used to securely backup a data element. The method can also be referred to as a backup method, backup process or initialization phase.

The method, according to the first aspect of the preset invention, comprises generating M data element shares based on a data element. M is an integer greater than 1. That is, based on the data element, a plurality of data element shares can be generated.

Further, the method comprises a first data processing unit encrypting each of the M data element shares with an encryption key, respectively. That is, M encryption keys can be provided and each of the M encryption keys can be used to encrypt a respective data element share. Thus, M encrypted data element shares can be generated. Again, each of the M encrypted data element shares can be generated by encrypting a data element share with a respective encryption key.

Each encryption key corresponds to a decryption key, respectively. That is, a one-to-one mapping may exist between the M encryption keys and M decryption keys. An encryption key and the corresponding decryption key can form a key pair. Data encrypted by the encryption key can be decrypted by the decryption key corresponding to the encryption key. That is, if data encrypted by an encryption key can be decrypted using a decryption key then the encryption key and the decryption key correspond to each other.

Further, the method can comprise the first data processing unit outputting the M encrypted data element shares. As discussed, the M encrypted data element shares correspond to data element shares in an encrypted state. As such, the M encrypted data element shares can be output without compromising the security of the data element.

Thus, instead of simply encrypting and storing secret data, as is typical for prior art techniques, the present invention generates a plurality of shares of the secrets, encrypts each share with a respective encryption key and outputs the encrypted data element share. This can allow for the responsibility of maintaining the secrecy of a data element to be shared.

For example, M users can be selected for holding a data element share. The M users can, for example, be co-owners of the data element. For example, the data element may relate to valuable assets (e.g. cryptocurrency assets, or private key(s) corresponding to cryptocurrencies). Each user may comprise (or generate) a cryptographic identity, that is, an encryption key and a corresponding decryption key. In other words, each of the M encryption keys with the corresponding decryption key can correspond to (i.e. can be owned by) a user. Further, each user can be provided with the encrypted data element share that was generated using the user's encryption key. As such, each user can store its corresponding encrypted data element share or at least the respective decryption keys for decrypting each encrypted data element share provided that the encrypted data element share is stored on a memory component, e.g., in a database. Put simply, each user can be responsible for maintaining the secrecy of only one respective data element share of the data element. Thus, the method of the present invention can be particularly advantageous for storing data related to assets co-owned by multiple users. A person skilled in the art will understand that the user of the above example can comprise one or more user devices that can be configured to comprise or generate a cryptographic identity, storing an encrypted data element share, storing an encrypting key and storing a corresponding decryption key. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card).

Furthermore, the method can be advantageous for increasing robustness against losing the data element, e.g., by generating redundant shares. Typically, prior art techniques increase robustness by storing multiple copies of the data to be kept secret. However, this sacrifices security. The more copies of secret data are stored, the higher the likelihood of one of the copies being stolen. The present technology increases robustness against losing the data element without sacrificing security. For example, as will be discussed in the following, the redundant data element shares can be generated, such that, even if losing one or more data element shares, the data element can still be recovered.

In addition, the method can provide high security as the data element may never be output outside the first data processing unit. As discussed, the method comprises outputting encrypted data element shares. However, without the decryption keys, obtaining the data element shares from the encrypted data element shares is computationally unfeasible.

To further increase security, only the encryption keys can be provided to the first data processing unit. In fact, the decryption keys may not be present at all during the execution of the described method. That is, the first data processing unit and the respective memory components storing the decryption keys may be physically separated, i.e., in remote locations relative to each other. Alternatively or additionally, the respective memory components storing the decryption keys may be offline, i.e., any communication with a device external to said memory components may be blocked by hardware (e.g. a switch) and/or software. Alternatively or additionally, the respective memory components may store the respective decryption keys in a secure manner (e.g. encrypted) and may be configured to decrypt/output the decryption keys during the method. As such, during the above method the data element may not be recovered, preferably, even by the holders of the M encryption keys (i.e. users).

Further still, the first data processing unit may comprise a tamperproof secure microcontroller, such as, a NXP SmartMX secure microcontroller family, e.g. the NXP SmartMX3 P71D321. The use of secure microcontrollers can be particularly advantageous for increasing the security of transactions (i.e. data communications) between the first data processing unit and an external device. That is, a secure microcontroller can facilitate hiding the data element even in case of malware presence. The secure microcontroller can be configured to mitigate side channel attack to discover the data element, can be sandboxed from the rest of the first data processing unit, and can be brute force resistant (e.g. self-destroys after a limited number of failed authentications).

Preferably, the first data processing unit may comprise a secure portion (which can also be referred to as secure enclave). The secure portion can provide hardware and software protection for maintaining the secrecy of the data element. The secure portion can comprise one or more secure microcontroller and one or more secure memory components. The data element and the data element shares (i.e. unencrypted data) can be processed and stored only inside the secure portion. The secure portion can further be configured to output the data element shares only in an encrypted state, i.e., the encrypted data element shares.

Further, the first data processing unit may comprise further components external to the secure portion. These can for example be, a general processor, general microcontroller, general memory devices and I/O interfaces. Said components can facilitate receiving and sending data to/from an external device. Again, outside the secure portion only encrypted data can be present.

Thus, by separating security tasks (e.g. encrypting and decrypting) from general tasks (e.g. communication protocols), the security of the data element can be increased. This, as discussed, can be performed by providing a secure portion of the first data processing unit which can comprise a secure microcontroller (e.g. NXP P71 microcontroller).

It will be noted that the data element can also be referred to as a secret and may comprise a master private key. Similarly, the data element share can also be referred to as a secret share or share and may refer to a share of the data element that is in an unencrypted state. On the other hand, the encrypted data element share can also be referred to as an encrypted secret share or encrypted share and refers to a share of the data element in an encrypted state. A first data processing unit can also be referred to as a backup device. Furthermore, the term key refers to a cryptographic key.

The data element can be determined with N unencrypted data element shares, where N is an integer greater than or equal to 1, and smaller than or equal to M. That is, the data element shares can be generated based on the data element such that at least N data element shares in an unencrypted state are required to determine the data element. In other words, the data element shares can be generated such that some of the data element shares can be redundant. This can be advantageous because it can increase robustness against the loss of decryption keys and/or data element shares. More particularly, at most M-N decryption keys can be lost and the data element can still be determined. Similarly, at most M-N encrypted data element shares can be lost and the data element can still be determined. In general, it would require M-N+1 data element shares to be lost in order to not be able to determine the data element share in a computationally feasible way. A data element share is considered lost if the corresponding unencrypted data element share is lost and/or if the corresponding decryption key is lost.

Each of the M encryption keys can be stored on a separate encryption key storage unit respectively. That is, M separate encryption key storage units can be provided, each storing a respective encryption key of the M encryption keys. Each of the M encryption key storage units can correspond to (i.e. be owned by) a respective user. For example, each of the M encryption key storage units can be a user device corresponding to a user or can be part of (i.e. integrated in or internal to) a user device corresponding to a user. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card). That is, M users can comprise a respective encryption key which can be stored on the user's respective encryption key storage unit or on the user's respective user device comprising an encryption key storage unit. Each of the encryption key storage units can be a stand-alone memory component that can store an encryption key. Alternatively, each of the encryption key storage units can be part of a respective memory component that can store, among other data, an encryption key of the M encryption keys. In some embodiments, each encryption key storage unit can be integrated in or comprised by a smart card (e.g. a contact or contactless card, such as, a near field communication (NFC) card). Furthermore, each smart card can be owned by (i.e. correspond to) a respective user.

As discussed, the encrypted data element shares can be output by the first data processing unit. After that, the encrypted data element shares can be stored either in a distributed manner or in a centralized manner or both.

That is, the method can comprise storing each of the encrypted data element shares on separate data share storage units, respectively. That is, M separate data share storage units can be provided, each for storing a respective encrypted data element share of the M encrypted data element shares. Each of the M data share storage units can correspond to (i.e. be owned by) a respective user. For example, each of the M data share storage units can be a user device corresponding to a user or can be part of (i.e. integrated in or internal to) a user device corresponding to a user. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card). That is, M users can be provided with a respective encrypted data element share which can be stored on the user's respective data share storage unit or on the user's respective user device comprising a data share storage unit. Each of the data share storage units can be a stand-alone memory component that can store an encrypted data element share. Alternatively, each of the data share storage units can be part of a respective memory component that can store, among other data, an encrypted data element share of the M encrypted data element shares. In some embodiments, each data share storage unit can be integrated in or comprised by a smart card (e.g. a contact or contactless card, such as, a near field communication (NFC) card). Furthermore, each smart card can be owned by (i.e. correspond to) a respective user.

Storing the encrypted data element shares in respective data share storage units can be advantageous as it can allow sharing the encrypted data element shares. For example, M users, each owning a respective data share storage unit, can be provided with a corresponding encrypted data element share. It will be noted that an encrypted data element share can correspond to a user if the encryption key used to generate the encrypted data element share also corresponds to the user. Similarly, an encrypted data element share can correspond to a user if the decryption key that can be used to decrypt the encrypted data element share also corresponds to the user.

Alternatively or additionally, the method can comprise storing each of the M encrypted data element shares on a database. Thus, all the data element shares can be stored on a database. As the encrypted data element shares are in an encrypted state, the database need not be a secure database. That is, the database can be a public database.

Furthermore, it can be advantageous to store each of the M encrypted data element shares on a separate data share storage unit and on a database. That is, the encrypted data element shares can in addition be backed up on a database. Hence, if one of the data share storage units gets damaged or lost, then the respective encrypted data element share stored therein can be obtained from the database.

Again, each of the M encryption keys used to encrypt a data element share and generate an encrypted data element share can be stored on a respective encryption key storage unit. On the other hand, each encrypted data element share can be stored on a respective data share storage unit. As each encryption key is used to generate a respective encrypted data element share, each encryption key storage unit can correspond to a data share storage unit. In other words, a one-to-one mapping can exist between the M encryption key storage units and M data share storage units, which mapping indicates which encryption key is used for generating which encrypted share.

In some embodiments, pairs of corresponding encryption key storage units and data share storage units can be internal to respective data storage units. More particularly, M separate data storage units can be provided. Each of the M data storage unit can respectively comprise one encryption key storage unit and on data share storage unit wherein the encryption key stored on the encryption key storage unit of the respective data storage unit is used to generate the encrypted data element share stored on the respective data share storage unit of the respective data storage unit. In other words, each of the data storage units can store a respective encryption key and a respective encrypted data element share, wherein the encrypted data element share is generated using the encryption key. Put simply, each of the data storage units can store an encryption key and the corresponding encrypted data element share.

Each of the M data storage units can correspond to (i.e. be owned by) a respective user. For example, each of the M data storage units can be a user device corresponding to a user or can be part of (i.e. integrated in or internal to) a user device corresponding to a user. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card). That is, each of the M users can comprise a respective encryption key which can be stored on the user's data storage unit or on the user's respective user device comprising a data storage unit. Furthermore, M users can be provided with a respective encrypted data element share which can be stored on the user's respective data storage unit or on the user's respective user device comprising a data storage unit. Each of the data storage units can be a stand-alone memory component that can store an encryption key and the corresponding encrypted data element share. Alternatively, each of the data storage units can be part of a respective memory component that can store, among other data, an encryption key and the corresponding encrypted data element share of the M encrypted data element shares. In some embodiments, each data storage unit can be integrated in or comprised by a smart card (e.g. a contact or contactless card, such as, a near field communication (NFC) card). Furthermore, each smart card can be owned by (i.e. correspond to) a respective user.

Put simply, an encryption key and the corresponding encrypted data element share can be stored on separate storage units, i.e., in an encryption key storage unit and data share storage unit, respectively. Alternatively, an encryption key and the corresponding encrypted data element share can be stored on a single storage unit, i.e., in a data storage unit.

Storing an encryption key and the corresponding encrypted data element share in a respective data storage unit can be advantageous because the correspondence between encryption keys and encrypted data element shares is indicated by the physical storage location. That is, if an encryption key and an encrypted data element share are stored on the same data storage unit, then they the encryption key and the encrypted data element share correspond to each other, i.e., the encrypted data element share is generated using that encryption key.

Furthermore, storing an encryption key and the corresponding encrypted data element share in a respective data storage unit may require only one interface with the first data processing unit. Said interface (i.e. communication channel) can be established between each data storage unit and the first data processing unit. Thus, respective interfaces can be used to provide the encryption key from each data storage unit to the first data processing unit. Additionally, respective interfaces can be used to provide the corresponding encrypted data element share from the first data processing unit to the data storage unit.

For example, each user may provide its respective data storage unit (or user device comprising the data storage unit). A respective communication channel can be established between each data storage unit and the first data processing unit, i.e., each data storage unit can be connected for data transmission with the first data processing unit. In some embodiments, all of the M data storage units can be connected simultaneously with the first data processing unit. Thus, the first data processing unit may be configured for simultaneously being connected to M external devices, such as, M data storage units or M user devices. For example, the first data processing unit may comprise M separate interfaces (e.g. M ports, such as, M smart card readers) and/or less then M separate interfaces configured for multiplexing multiple connections. Alternatively, the M data storage units can be connected less then M at a time (e.g. one at a time, two a time, three at a time).

Each data storage unit can provide the encryption key which it stores to the first data processing unit. The first data processing unit, using the received encryption key from a data storage unit, can encrypt a data element share, thus generating an encrypted data element share. The first data processing unit outputs the encrypted data element share to the data storage unit, wherein the encrypted data element share can be stored.

In embodiments, wherein the M encrypted data element shares can be stored on a database, the database can be an external database. More particularly, the database can be external to all the encryption key storage units. Furthermore, the database can be external to all the data share storage units. That is, the database can be a stand-alone component. For example, the database may be a remote database.

Thus, the step of the first data processing unit outputting the M encrypted data element shares can comprise the first data processing unit providing each of the M encrypted data element shares to a separate data share storage unit, respectively. This can be advantageous, as each of the M encrypted data element shares can be directly provided to the respective data share storage unit from the first data processing unit.

As discussed, in some embodiments, each data storage unit may be comprised by (i.e. internal to) a data storage unit. In such embodiments, the step of the first data processing unit providing each of the M encrypted data element shares to a separate data share storage unit, respectively, can comprise the first data processing unit providing to each data storage unit of the M data storage units a corresponding encrypted data element share. Again, an encrypted data element share of the M encrypted data element shares corresponding to a data storage unit of the M data storage units means that the encryption key with which the encrypted data element share is generated is stored on the respective data storage unit, such as, in the respective encryption key storage unit of the respective data storage unit. This can be advantageous, as each of the M encrypted data element shares can be directly provided to the respective data storage unit from the first data processing unit.

Alternatively or additionally, outputting the M encrypted data element shares can comprise the first data processing unit providing each of the M encrypted data element shares to the database. This can be advantageous, as the M encrypted data element shares can be directly provided to the database from the first data processing unit.

In some embodiments, the step of based on a data element, generating M data element shares, can be based on a secret sharing scheme, preferably a threshold secret sharing scheme with a total number of shares equal to M and threshold equal to N, such as, the Shamir's secret sharing scheme and/or the Berkley's secret sharing scheme. It will be noted that a secret sharing scheme can also be referred to as secret sharing, secret splitting or secret splitting scheme.

Using a secret sharing scheme, such as, the Shamir's secret sharing scheme or the Berkley's secret sharing scheme, can be advantageous as it can provide an efficient way for generating the data element shares based on a data element. Furthermore, they can allow the generation of any number of data element shares (i.e. M can be any number) and they can also allow the threshold (i.e. number of data element shares for determining the data element) to be any number between 1 and M. Moreover, the data element shares can be generated, such that, they do not comprise actual parts of the contents of the data element. That is, even if a data element share can be obtained (e.g. by decrypting an encrypted data element share), contents of the data element are not revealed. In other words, a secret sharing scheme can be configured such that anyone with fewer than N data element shares can comprise no more information about the data element than someone with 0 shares, in that, the data element share can be obtained in a computationally feasible way. This can guarantee that the data element is secured as long as M− N+ 1 data element shares are not obtained.

For example, the data element shares can be generated by mapping the data element to a point of a graph represented by a polynomial, wherein the polynomial has a degree of N−1 and generating the M data element shares based on M different points of the graph represented by the polynomial. Preferably, the point wherein the data element can be mapped is different from the M different points based on which the M data element shares can be generated. Thus, the data element cannot be distributed as one of the data element shares. The polynomial can be generated by randomly generating N−1 coefficients of the polynomial and calculating the N th coefficient such that the point wherein the data element is mapped lies on the graph represented by the polynomial.

In some embodiments, the step of based on a data element, generating M data element shares is carried out by the first data processing unit. Thus, the data element shares can be generated and encrypted on the first data processing unit. This can increase security as the data element shares can live in an unencrypted state only inside the first data processing unit.

The method can further comprise providing each of M encryption keys to the first data processing unit.

For example, each of the M encryption keys stored on a respective separate encryption key storage unit can be provided to the first data processing unit. That is, the M different encryption keys can be stored on or correspond to other devices external to the first data processing unit and can be provided to the first data processing unit for encrypting the data element shares. For example, each of the M encryption keys can be provided from the respective encryption key storage unit to the first data processing unit.

Each of the M encryption keys can be stored on a respective user device. That is, M separate user devices can be provided, each storing a respective encryption key of the M encryption keys. Each user device can for example be a smartphone, tablet, laptop, pocket computer, cellphone, smart card, contact card and/or contactless cars (e.g. NFC card).

Each of the M user devices can comprise a respective encryption key storage unit that can store an encryption key. Thus, each of the M user devices can comprise a corresponding encryption key. The encryption key corresponding to a user device can be used to increase the security of communication with the user device. This can be achieved by encrypting data to be provided to the user device with the encryption key of the user device before providing the data to the user device. Hence, data can be provided in an encrypted state to the user device. For example, the data element shares can be encrypted with the encryption key of a user device, before providing it to the user device. Instead of providing the data element share to the user device, the encrypted data element share can be provided. Thus, even if the communication between the user device and the first data processing unit is intercepted by a non-authorized user or device, information on the content of the data element share cannot be obtained.

Alternatively or additionally, each of the M user device can comprise a respective data share storage unit. Thus, the encrypted data element shares can be stored on the user device.

In some embodiments, each of the M user devices may comprise a respective encryption key storage unit and a respective data share storage unit. In other words, each of the M user device may comprise a respective data storage unit that can store an encryption key (in an encryption key storage unit comprised therein) and a corresponding encrypted data element share (in a data share storage unit comprised therein).

For example, each user may provide its respective user device. A respective communication channel can be established between each user device and the first data processing unit, i.e., each user device can be connected for data transmission with the first data processing unit. In some embodiments, all of the M user devices can be connected simultaneously with the first data processing unit. Thus, the first data processing unit may be configured for simultaneously being connected to M external devices, such as, M user devices. For example, the first data processing unit may comprise M separate interfaces (e.g. M ports, such as, M smart card readers, M receiver antennas) and/or less than M separate interfaces configured for multiplexing multiple connections. Alternatively, the M user devices can be connected less than M at a time (e.g. one at a time, two a time, three at a time).

Each user device can provide its corresponding encryption key, which it stores, to the first data processing unit. The first data processing unit, using the received encryption key from a user device, can encrypt a data element share, thus generating an encrypted data element share. The first data processing unit can output the encrypted data element share to the user device, wherein the encrypted data element share can be stored. Thus, each user device can store an encryption key, be provided with an encrypted data element share obtained using the encryption key of the user device and store the provided encrypted data element share.

In some embodiments, the step of providing to the first data processing unit M different encryption keys comprises providing each encryption key with a corresponding digital certificate, such as, a X.509 certificate. Digital certificates are particularly advantageous for proving the ownership of an encryption key and/or the authenticity of the sender of the encryption key. Typically, digital certificates are issued by a third-party entity, also referred to as a certificate authority (CA) that is known and trusted by the communicating parties.

The step of the first data processing unit encrypting each of the M data element shares with an encryption key can be based on an asymmetric encryption scheme, such as, RSA, ECC P256k1, ECC P256r1, or X25519. In an asymmetric encryption scheme two cryptographic keys are used: a private key and a public key. For secure communication, the public key of a receiver is used by a sender to encrypt data and the private key of the received is used by the receiver to decrypt data. Thus, if an asymmetric encryption scheme is used for encrypting the data element shares, each of the encryption keys is a public key and each of the decryption keys is a private key. However, it will be understood that the above are only some exemplary encryption schemes that can be used.

In some embodiments, the method can further comprise storing each of the M decryption keys corresponding to each of the M encryption keys, respectively, on a separate decryption key storage unit, respectively. Storing the decryption keys on separate decryption key storage units can be a particularly secure way of storing the decryption keys. It will be noted that maintaining the secrecy of the data element depends on maintain the secrecy of the decryption keys. As such, the separate decryption key storage units can be a secure memory or part of a secure memory, such as, a self-encrypted memory. That is, the separate decryption key storage units can be configured to securely store the respective decryption key, e.g., by storing the respective decryption key in an encrypted state.

Furthermore, storing the decryption keys on separate decryption key storage units can facilitate prohibiting the provision or use of the decryption keys during the method of the first aspect of the present invention. That is, during the backup of the data element, the decryption key storage units may not be present or may not be provided or may be configured not to output the decryption key in an unencrypted state. As such, during the backup method the data element cannot be determined because, as discussed, the decryption key storage units can be configured to make it difficult or computationally unfeasible to obtain the decryption keys stored therein.

In some embodiments, M separate computing units can be provided each configured to access a respective encryption key storage unit. The computing unit may be a single processor or a plurality of processors, and may be, a CPU (central processing unit), GPU (graphical processing unit), DSP (digital signal processor), APU (accelerator processing unit), ASIC (application-specific integrated circuit), ASIP (application-specific instruction-set processor) or FPGA (field programable gate array). Thus, each computing unit can be provided with the encryption key stored on the respective encryption key storage unit that the computing unit can access. In addition, the computing unit can access a respective data share storage unit that stores the encrypted data element share which encryption key is stored on the encryption key storage unit. That is, the computing unit can be provided with an encrypted data element share corresponding to the encryption key that the computing unit can receive from the encryption key storage unit it can access. Alternatively or additionally, the computing unit can be configured to access the database. Thus, the computing unit can be provided from the database with an encrypted data element share corresponding to the encryption key that the computing unit can receive from the encryption key storage unit it can access.

Furthermore, each of the M computing units can be configured to access a respective decryption key storage unit wherein the decryption key stored therein corresponds to the encryption key stored on the encryption key storage unit that the computing unit is configured to access.

Thus, the computing unit can receive an encryption key, the encrypted data element share encrypted with said encryption key and the decryption key corresponding to the said encryption key and that can be used to decrypt the said encrypted data element share.

For each computing unit, the respective computing unit and the respective encryption key storage unit, that the computing unit is configured to access, can be integrated into a single device. For example, a user device may comprise one computing unit and one encryption key storage unit, wherein the computing unit is configured to access the encryption key storage unit.

For each computing unit, the respective computing unit and the respective data share storage unit, that the computing unit is configured to access, can be integrated into a single device. For example, a user device may comprise one computing unit and one data share storage unit, wherein the computing unit is configured to access the data share storage unit.

For each computing unit, the respective computing unit, the respective encryption key storage unit and the respective data share storage unit, that the computing unit is configured to access, can be integrated into a single device. For example, a user device may comprise one computing unit and one encryption key storage unit and one data share storage unit, wherein the computing unit is configured to access the encryption key storage unit and the data share storage unit.

For each computing unit, the respective computing unit and the respective decryption key storage unit, that the computing unit is configured to access, are integrated into a single device. For example, a user device may comprise one computing unit and one decryption key storage unit, wherein the computing unit is configured to access the decryption key storage unit.

In some embodiments, the first data processing unit may execute an authentication protocol prior to transferring data with an external device. That is, before sending data to an external device the first data processing unit can execute an authentication protocol to verify the identity of the external device. Similarly, before receiving data from an external device the first data processing can execute an authentication protocol to verify the identity of the external device. The external device can be each of the encryption key storage units, each of the data share storage units, the database, each of the data storage units, each of the user devices, each of the computing units, as discussed in the respective embodiments above.

Thus, the first data processing unit can communicate only with authenticated devices. As such, an un-authorized device may not send and/or receive data to/from the first data processing unit. This can decrease the risk of an un-authorized device breaching the security of the first data processing unit.

Different authentication protocols can be executed by the first data processing unit for authenticating an external device, such as, each of the data share storage units, the database, each of the data storage units, each of the user devices, each of the computing units, as discussed in the respective embodiments above. That is, the present invention is not limited to a particular authentication protocol. For example, the authentication protocol that can be executed by the first data processing unit can be based on a password authentication protocol (PAP), challenge-handshake authentication protocol (CHAP), extensible authentication protocol (EAP), authentication-authorization-accounting (AAA) architecture protocols, such as, terminal access controller access-control system (TACACS), Extended TACACS, TACACS+, remote authentication dial-in user service (RADIUS), diameter protocol, Kerberos protocol, RFID authentication protocols, physical unclonable function (PUF) based authentication or any combination thereof.

Typically, authentication of the external device by the first data processing unit can be based on a challenge-response authentication, wherein the first data processing unit can provide a challenge to the external device and the external device is required to provide a valid response to the challenge to be authenticated.

Similarly, the external device can execute an authentication protocol (e.g. any of the above-mentioned authentication protocols) for authenticating the first data processing unit before sending and/or receiving data to/from the first data processing unit. In such embodiments, the external device can send a challenge to the first data processing unit and the first data processing unit is required to provide a valid response to the challenge to be authenticated.

In some embodiments, only upon successful authentication of the external device by the first data processing unit and/or the first data processing unit by the external device, communication between the external device and the first data processing unit may initiate. Again, for the sake of brevity, the term external device is used in the above to refer to any of each of the encryption key storage units, each of the data share storage units, the database, each of the data storage units, each of the user devices, each of the computing units, as discussed in the respective embodiments above.

In some embodiments, the method can comprise storing each of the M encrypted data elements shares on the first data processing unit. This can be performed for backup purposes.

In some embodiments, wherein the data element can be determined with N unencrypted data element shares, the data element can be equal to 2. That is, the data element can be determined with at least 2 of the M data element shares in an unencrypted state. As will be discussed further below, this can be particularly advantageous for providing a seamless end user experience for performing digital signatures with the data element, while at the same time maintaining the security of the data element.

In such embodiments, the method can comprise storing one of the M data element shares in the first data processing unit and storing each of the remaining M−1 data element shares in a respective password protected storage. This can further facilitate providing a seamless end user experience for performing digital signatures with the data element, while at the same time maintaining the security of the data element.

In some embodiments, the method can comprise generating a respective password for each of the M−1 password protected storages.

Each of the M−1 password protected storages can allow access to the data stored therein if the corresponding password is provided. This may increase security against an unauthorized party accessing the data stored in the password protected storage.

In some embodiments, storing each of the remaining M−1 data element shares in a respective password protected storage comprises storing each of the remaining M−1 data element shares encrypted with the password generated for the respective password protected storage. Thus, even when access to the password protected storage can be gained, without the respective password of the password protected storage the data element share cannot be obtained in an unencrypted state. This facilitates the password protected storage allowing access to the data stored therein only if the corresponding password is provided.

In some embodiments, generating a respective password for each of the M−1 password protected storages can comprise each of M−1 users defining a user defined password for a respective password protected storage.

Additionally or alternatively, generating a respective password for each of the M−1 password protected storages can comprise generating a respective computer program specific password and each computer program specific password can be used by a respective computer program to access the data element share stored in the respective password protected storage that the computer program specific password corresponds to. Generating a respective password for each of the M−1 password protected storages can facilitate the automation of receiving a data element share stored in a respective password protected storage. This can further facilitate providing a seamless end user experience for performing digital signatures with the data element, while at the same time maintaining the security of the data element.

Each of the M−1 computer programs can be executed on a respective user device.

At least one of the computer program specific passwords may be an app-specific password. In such embodiments, the computer program can be an application software (typically also referred to as app).

Each of the M−1 password protected storages can be part of a respective cloud-based storage. The cloud-based storage can, for example, be Google Drive developed by Google LLC.

Each cloud-based storage can correspond to a respective user. For example, each user can comprise an account with respect to a cloud-based storage service provider, hence being provided with a storage space on the cloud-based storage, which the user can access with a user device.

For each cloud-based storage, credential data can be generated and each cloud-based storage can be accessed only if the correct credential data are provided. For example, the credential data can be linked to the account with respect to the user on the cloud-based storage service provider

Each of the credential data can comprise a unique ID and at least one of a password, a one-time PIN, biometric data of a user, a digital certificate and a private key.

In some embodiments, the method can be a computer implemented method. This can allow the automation of generating M data element share based on a data element, encrypting each of the M data element shares and thus generating M encrypted data element shares and outputting the M encrypted data element shares. That is, the method can be implemented as a set of computer-instructions which can be carried out by one or more processing devices, one of each being the first data processing unit.

In a further aspect, the present invention relates to a first computer program comprising instructions which, when the program is executed by a first data processing unit causes the first data processing unit to encrypt, according to any of the preceding method embodiments, each of M data element shares with an encryption key, respectively, and thus generating M encrypted data element shares, wherein each of the encryption keys corresponds to a decryption key, respectively.

Further, the first computer program can cause the first data processing unit to transmit, according to any of the preceding method embodiments, each of the encrypted data element shares to at least one of a respective encryption key storage unit and database.

The first computer program can be provided to first data processing unit, e.g., in a memory component of the first data processing unit, and can facilitate the first data processing unit to automatically carry out part of the steps of the method according to any of the above discussed embodiments.

In a further aspect, the present invention relates to a second computer program comprising instructions which, when the program is executed by a first data processing unit causes the first data processing unit to carry out or facilitate the steps of the method according to any of the preceding method embodiments.

In a further aspect, the present invention relates to a third computer program comprising instructions which, when the program is executed by an external device can cause the external device to provide an encryption key comprised by the external device to the first data processing unit. This is particularly advantageo

CLAIMS

Claims ( 16 )

What is claimed is:

1. A method comprising:

based on a data element, generating M data element shares of the data element, wherein M is an integer greater than 1;

a first data processing unit encrypting each of the M data element shares with a respective encryption key, and thus generating M encrypted data element shares, wherein each of the encryption keys corresponds to a respective decryption key;

providing to a device at least N of M of the data element shares in an unencrypted state, wherein N is an integer greater than or equal to 1 and smaller than or equal to M; and

the device determining the data element based on the at least N data element shares in the unencrypted state;

wherein the providing to the device at least N of M of the data element shares in an unencrypted state comprises:

providing at least N temporary encrypted data element shares to the device; and

unencrypting each of the at least N temporary encrypted data element shares on the device and thus obtaining the at least N data element shares in an unencrypted state; and

wherein the providing at least N temporary encrypted data element shares to the device comprises each of at least N computing units performing the steps of:

decrypting a respective one of the M encrypted data element shares to obtain a respective data element share in an unencrypted state;

encrypting the respective data element share in the unencrypted state using a temporary encryption key to generate a respective temporary encrypted data element share; and

providing the respective temporary encrypted data element share to the device.

2. The method according to claim 1 , wherein each encryption key is identical to the corresponding decryption key.

3. The method according to claim 1 , wherein the first data processing unit is configured to execute an encryption routine to encrypt each of the M data element shares to generate M encrypted data element shares and wherein the encryption routine is based on a symmetric encryption scheme.

4. The method according to claim 1 , wherein:

each of the M decryption keys is respectively stored on a separate decryption key storage unit;

each of the at least N computing units is configured to access a respective decryption key storage unit; and

the method further comprises:

each of the at least N computing units receiving, from the decryption key storage unit that the respective computing unit is configured to access, the decryption key stored therein; and

decrypting the respective one of the M encrypted data element shares to obtain a respective data element share in an unencrypted state using the respective received decryption key.

5. The method according to claim 1 , wherein the device is different from the first data processing unit.

6. The method according to claim 1 , wherein:

the M data element shares are generated such that N unencrypted data element shares are required to determine the data element, where N is an integer greater than or equal to 1 and smaller than or equal to M; and

the step of generating M data element shares is based on a threshold secret sharing scheme with a total number of shares equal to M and a threshold equal to N.

7. The method according to claim 1 , wherein the step of generating M data element shares is carried out by the first data processing unit.

8. The method according to claim 1 , wherein:

the first data processing unit comprises a secure microcontroller configured to generate, based on the data element, data element shares and encrypt the data element shares; and

the device comprises a secure microcontroller configured to generate the data element based on the at least N data element shares.

9. A system comprising:

a first data processing unit configured to:

generate M data element shares based on a data element, wherein M is an integer greater than 1; and

encrypt each of the M data element shares with a respective encryption key, and to thus generate M encrypted data element shares, wherein each of the encryption keys corresponds to a respective decryption key;

a device configured to:

obtain at least N of M data element shares in an unencrypted state related to a data element, wherein M is an integer greater than 1 and N is an integer greater than or equal to 1 and smaller than or equal to M; and

determine the data element based on the at least N data element shares in the unencrypted state; and

at least N computing units;

wherein the device is configured to obtain the at least N of M data element shares in an unencrypted state by:

obtaining at least N temporary encrypted data element shares; and

unencrypting each of the at least N temporary encrypted data element shares on the device and thus obtaining the at least N data element shares in an unencrypted state; and

wherein each of the at least N computing units is configured to:

decrypt a respective one of the M encrypted data element shares to obtain a respective data element share in the unencrypted state;

encrypt the respective data element share in the unencrypted state using a temporary encryption key to generate the respective temporary encrypted data element share; and

provide the respective temporary encrypted data element share to the device.

10. The system according to claim 9 , wherein each encryption key is identical to the corresponding decryption key.

11. The system according to claim 9 , wherein the first data processing unit is configured to execute an encryption routine to encrypt each of the M data element shares to generate M encrypted data element shares and wherein the encryption routine is based on a symmetric encryption scheme.

12. The system according to claim 9 , further comprising at least N separate decryption key storage units, each configured to store a respective decryption key;

wherein each of the at least N computing units is configured to:

access a respective decryption key storage unit;

receive, from the decryption key storage unit that the respective computing unit is configured to access, the decryption key stored therein; and

decrypt the respective one of the M encrypted data element shares to obtain a respective data element share in an unencrypted state using the received decryption key.

13. The system according to claim 9 , wherein the device is different from the first data processing unit.

14. The system according to claim 9 , wherein each of the at least N computing units comprises a secure microcontroller for executing security sensitive tasks.

15. The system according to claim 9 , wherein:

the data element can be determined with N unencrypted data element shares, where N is an integer greater than or equal to 1 and smaller than or equal to M; and

the first data processing unit is configured to generate M data element shares based on a threshold secret sharing scheme with a total number of shares equal to M and a threshold equal to N.

16. The system according to claim 9 , wherein:

the first data processing unit comprises a secure microcontroller configured to generate, based on the data element, data element shares and encrypt the data element shares; and

the device comprises a secure microcontroller configured to generate the data element based on the at least N data element shares.

US18/223,669

2020-01-29

2023-07-19

Storing and determining a data element

Active

US12101400B2

( en )

Priority Applications (2)

Application Number

Priority Date

Filing Date

Title

US18/223,669

US12101400B2

( en )

2020-01-29

2023-07-19

Storing and determining a data element

US18/792,706

US20240396725A1

( en )

2020-01-29

2024-08-02

Storing and determining a data element

Applications Claiming Priority (5)

Application Number

Priority Date

Filing Date

Title

EP20154430.1

2020-01-29

EP20154430.1A

EP3860035A1

( en )

2020-01-29

2020-01-29

Storing and determining a data element

EP20154430

2020-01-29

US17/162,265

US11791996B2

( en )

2020-01-29

2021-01-29

Storing and determining a data element

US18/223,669

US12101400B2

( en )

2020-01-29

2023-07-19

Storing and determining a data element

Related Parent Applications (1)

Application Number

Title

Priority Date

Filing Date

US17/162,265

Continuation

US11791996B2

( en )

2020-01-29

2021-01-29

Storing and determining a data element

Related Child Applications (1)

Application Number

Title

Priority Date

Filing Date

US18/792,706

Continuation

US20240396725A1

( en )

2020-01-29

2024-08-02

Storing and determining a data element

Publications (2)

Publication Number

Publication Date

US20230370258A1

US20230370258A1 ( en )

2023-11-16

US12101400B2

true

US12101400B2 ( en )

2024-09-24

Family

ID=69400484

Family Applications (3)

Application Number

Title

Priority Date

Filing Date

US17/162,265

Active

2041-09-01

US11791996B2

( en )

2020-01-29

2021-01-29

Storing and determining a data element

US18/223,669

Active

US12101400B2

( en )

2020-01-29

2023-07-19

Storing and determining a data element

US18/792,706

Pending

US20240396725A1

( en )

2020-01-29

2024-08-02

Storing and determining a data element

Family Applications Before (1)

Application Number

Title

Priority Date

Filing Date

US17/162,265

Active

2041-09-01

US11791996B2

( en )

2020-01-29

2021-01-29

Storing and determining a data element

Family Applications After (1)

Application Number

Title

Priority Date

Filing Date

US18/792,706

Pending

US20240396725A1

( en )

2020-01-29

2024-08-02

Storing and determining a data element

Country Status (2)

Country

Link

US

( 3 )

US11791996B2

( en )

EP

( 2 )

EP3860035A1

( en )

Families Citing this family (20)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

WO2021226989A1

( en )

*

2020-05-15

2021-11-18

华为技术有限公司

Communication method and communication apparatus

US11870898B2

( en )

2020-05-21

2024-01-09

Workday, Inc.

Split keys for wallet recovery

US11405200B1

( en )

*

2020-05-21

2022-08-02

Workday, Inc.

Multilevel split keys for wallet recovery

US12113895B2

( en )

*

2020-12-11

2024-10-08

PUFsecurity Corporation

Key management system providing secure management of cryptographic keys, and methods of operating the same

US20220271933A1

( en )

*

2021-02-19

2022-08-25

Samsung Electronics Co., Ltd.

System and method for device to device secret backup and recovery

EP4047587A1

( en )

*

2021-02-22

2022-08-24

HENSOLDT Sensors GmbH

Chip device and method for a randomized logic encryption

EP4060540A1

( en )

*

2021-03-17

2022-09-21

Sebastien Armleder

Devices, systems, and methods for performing a digital signature

CN113704741B

( en )

2021-09-01

2025-11-28

上海兆芯集成电路股份有限公司

Processor with elliptic curve cryptography algorithm and processing method thereof

CN113722700B

( en )

*

2021-09-01

2026-02-03

上海兆芯集成电路股份有限公司

Processor with elliptic curve cryptography algorithm and processing method thereof

CN113961947A

( en )

2021-09-01

2022-01-21

上海兆芯集成电路有限公司

Processor with Hash cipher algorithm and processing method thereof

CN114372274B

( en )

*

2021-12-07

2024-12-27

广州大学

A remote data backup encryption method, system, device and storage medium

US12438716B2

( en )

*

2022-05-31

2025-10-07

Lokblok Inc.

Non-custodial enrollment and recovery of a secret

US12432048B2

( en )

*

2022-06-13

2025-09-30

Cyberark Software Ltd.

Agentless single sign-on techniques

CN115297028B

( en )

*

2022-10-08

2023-01-03

浙江大华技术股份有限公司

Network card connectivity detection method and device, electronic device and storage medium

US20240323012A1

( en )

*

2023-03-22

2024-09-26

Capital One Services, Llc

Devices and methods for authenticating properties of physical objects

US20240372707A1

( en )

*

2023-05-02

2024-11-07

Nvidia Corporation

Protecting secrets with multi-party approval in computer networks

US12425191B1

( en )

2023-10-06

2025-09-23

The Bank Of New York Mellon

System and method for providing multiple key encryption

US12452049B2

( en )

2024-01-05

2025-10-21

Bank Of America Corporation

System and method for AI-based adaptive security parameter calculation in license key generation with quantum-resistant protections

US20250392459A1

( en )

*

2024-06-25

2025-12-25

Crossbar, Inc.

Backup and recovery system and methods for cryptocurrency hardware wallet

WO2026088824A1

( en )

*

2024-10-22

2026-04-30

ソニーグループ株式会社

Information processing device and information processing method

Citations (23)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US6662299B1

( en )

1999-10-28

2003-12-09

Pgp Corporation

Method and apparatus for reconstituting an encryption key based on multiple user responses

US6810122B1

( en )

1999-07-23

2004-10-26

Kabushiki Kaisha Toshiba

Secret sharing system and storage medium

US20070219915A1

( en )

*

2006-02-20

2007-09-20

Yasuo Hatano

Digital content encryption and decryption method and workflow system using digital content

US20080095375A1

( en )

*

2006-10-18

2008-04-24

Kabushiki Kaisha Toshiba

Secret information management apparatus and secret information management system

US7421080B2

( en )

2003-03-13

2008-09-02

Oki Electric Industry Co., Ltd.

Method of reconstructing a secret, shared secret reconstruction apparatus, and secret reconstruction system

US20080263363A1

( en )

*

2007-01-22

2008-10-23

Spyrus, Inc.

Portable Data Encryption Device with Configurable Security Functionality and Method for File Encryption

US20090019279A1

( en )

*

2007-07-03

2009-01-15

Takehisa Kato

User apparatus and program

US20090077379A1

( en )

*

2005-10-27

2009-03-19

Zeev Geyzel

Network Security System

US20100054481A1

( en )

*

2008-08-27

2010-03-04

Sushil Jajodia

Scalable Distributed Data Structure with Recoverable Encryption

US20110138192A1

( en )

*

2009-12-04

2011-06-09

Kocher Paul C

Verifiable, Leak-Resistant Encryption and Decryption

EP2375626A1

( en )

2010-03-29

2011-10-12

British Telecommunications public limited company

Data storage

US20130046973A1

( en )

2011-08-17

2013-02-21

Cleversafe, Inc.

Facilitating access of a dispersed storage network

US20140089683A1

( en )

2012-09-26

2014-03-27

Pure Storage, Inc.

Multi-drive cooperation to generate an encryption key

US9331984B2

( en )

2012-08-24

2016-05-03

Panasonic Intellectual Property Management Co., Ltd.

Secret sharing method and system

US20170093564A1

( en )

*

2015-09-30

2017-03-30

Pure Storage, Inc.

Resharing of a split secret

US20190109711A1

( en )

2010-05-19

2019-04-11

International Business Machines Corporation

Securely activating functionality of a computing device in a dispersed storage network

US20190318356A1

( en )

*

2018-04-17

2019-10-17

Coinbase, Inc.

Offline storage system and method of use

US20190319792A1

( en )

2018-04-16

2019-10-17

Xage Security, Inc.

Decentralized information protection for confidentiality and tamper-proofing on distributed database

US20190332792A1

( en )

*

2016-12-27

2019-10-31

ZenmuTech, Inc

Access management system, access management method and program

US20190342080A1

( en )

*

2018-05-01

2019-11-07

Huawei Technologies Co., Ltd.

Systems, Devices, and Methods for Hybrid Secret Sharing

US20200162240A1

( en )

*

2018-11-15

2020-05-21

Fujitsu Limited

Communication device and communication method used in decentralized network

US11082220B1

( en )

*

2019-10-17

2021-08-03

EMC IP Holding Company LLC

Securing recovery data distributed amongst multiple cloud-based storage services

US11115196B1

( en )

*

2015-12-08

2021-09-07

EMC IP Holding Company LLC

Methods and apparatus for secret sharing with verifiable reconstruction type

Family Cites Families (8)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

WO2008099682A1

( en )

*

2007-02-16

2008-08-21

Panasonic Corporation

Shared information distributing device, holding device, certificate authority device, and system

US9922063B2

( en )

*

2009-12-29

2018-03-20

International Business Machines Corporation

Secure storage of secret data in a dispersed storage network

US11032259B1

( en )

*

2012-09-26

2021-06-08

Pure Storage, Inc.

Data protection in a storage system

US9811677B2

( en )

*

2014-07-03

2017-11-07

Pure Storage, Inc.

Secure data replication in a storage grid

FR3024002B1

( en )

*

2014-07-21

2018-04-27

Ercom Eng Reseaux Communications

METHOD FOR SECURING A SECRET OF A USER AND METHOD FOR RESTORING A SECRET OF A USER

EP3704830B1

( en )

*

2017-10-30

2021-09-29

Visa International Service Association

Multi-party threshold authenticated encryption

US12047501B2

( en )

*

2018-06-01

2024-07-23

Roland Tegeder

System and method for providing an authorised third party with overt ledger secured key escrow access to a secret

US11734394B2

( en )

*

2019-10-23

2023-08-22

Lenovo (Singapore) Pte. Ltd.

Distributed license encryption and distribution

2020

2020-01-29

EP

EP20154430.1A

patent/EP3860035A1/en

not_active

Withdrawn

2021

2021-01-26

EP

EP21153562.0A

patent/EP3860038A1/en

active

Pending

2021-01-29

US

US17/162,265

patent/US11791996B2/en

active

Active

2023

2023-07-19

US

US18/223,669

patent/US12101400B2/en

active

Active

2024

2024-08-02

US

US18/792,706

patent/US20240396725A1/en

active

Pending

Patent Citations (23)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US6810122B1

( en )

1999-07-23

2004-10-26

Kabushiki Kaisha Toshiba

Secret sharing system and storage medium

US6662299B1

( en )

1999-10-28

2003-12-09

Pgp Corporation

Method and apparatus for reconstituting an encryption key based on multiple user responses

US7421080B2

( en )

2003-03-13

2008-09-02

Oki Electric Industry Co., Ltd.

Method of reconstructing a secret, shared secret reconstruction apparatus, and secret reconstruction system

US20090077379A1

( en )

*

2005-10-27

2009-03-19

Zeev Geyzel

Network Security System

US20070219915A1

( en )

*

2006-02-20

2007-09-20

Yasuo Hatano

Digital content encryption and decryption method and workflow system using digital content

US20080095375A1

( en )

*

2006-10-18

2008-04-24

Kabushiki Kaisha Toshiba

Secret information management apparatus and secret information management system

US20080263363A1

( en )

*

2007-01-22

2008-10-23

Spyrus, Inc.

Portable Data Encryption Device with Configurable Security Functionality and Method for File Encryption

US20090019279A1

( en )

*

2007-07-03

2009-01-15

Takehisa Kato

User apparatus and program

US20100054481A1

( en )

*

2008-08-27

2010-03-04

Sushil Jajodia

Scalable Distributed Data Structure with Recoverable Encryption

US20110138192A1

( en )

*

2009-12-04

2011-06-09

Kocher Paul C

Verifiable, Leak-Resistant Encryption and Decryption

EP2375626A1

( en )

2010-03-29

2011-10-12

British Telecommunications public limited company

Data storage

US20190109711A1

( en )

2010-05-19

2019-04-11

International Business Machines Corporation

Securely activating functionality of a computing device in a dispersed storage network

US20130046973A1

( en )

2011-08-17

2013-02-21

Cleversafe, Inc.

Facilitating access of a dispersed storage network

US9331984B2

( en )

2012-08-24

2016-05-03

Panasonic Intellectual Property Management Co., Ltd.

Secret sharing method and system

US20140089683A1

( en )

2012-09-26

2014-03-27

Pure Storage, Inc.

Multi-drive cooperation to generate an encryption key

US20170093564A1

( en )

*

2015-09-30

2017-03-30

Pure Storage, Inc.

Resharing of a split secret

US11115196B1

( en )

*

2015-12-08

2021-09-07

EMC IP Holding Company LLC

Methods and apparatus for secret sharing with verifiable reconstruction type

US20190332792A1

( en )

*

2016-12-27

2019-10-31

ZenmuTech, Inc

Access management system, access management method and program

US20190319792A1

( en )

2018-04-16

2019-10-17

Xage Security, Inc.

Decentralized information protection for confidentiality and tamper-proofing on distributed database

US20190318356A1

( en )

*

2018-04-17

2019-10-17

Coinbase, Inc.

Offline storage system and method of use

US20190342080A1

( en )

*

2018-05-01

2019-11-07

Huawei Technologies Co., Ltd.

Systems, Devices, and Methods for Hybrid Secret Sharing

US20200162240A1

( en )

*

2018-11-15

2020-05-21

Fujitsu Limited

Communication device and communication method used in decentralized network

US11082220B1

( en )

*

2019-10-17

2021-08-03

EMC IP Holding Company LLC

Securing recovery data distributed amongst multiple cloud-based storage services

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party

Title

" European Search Report dated Jun. 10, 2021, issued to counterpart European Application No. 21153562.0. "

" NXP Secure Microcontroller Smart MX3 P71D321 ", https://www.nxp.com/docs/en/fact-sheet/P71D321.pdf, 2018.

Also Published As

Publication number

Publication date

EP3860035A1

( en )

2021-08-04

US20210234678A1

( en )

2021-07-29

EP3860038A1

( en )

2021-08-04

US11791996B2

( en )

2023-10-17

US20230370258A1

( en )

2023-11-16

US20240396725A1

( en )

2024-11-28

Similar Documents

Publication

Publication Date

Title

US11791996B2

( en )

2023-10-17

Storing and determining a data element

Kumar et al.

2012

Secure storage and access of data in cloud computing

US9973334B2

( en )

2018-05-15

Homomorphically-created symmetric key

CN102396011B

( en )

2014-04-16

Encoding apparatus, decoding apparatus, encoding method, decoding method, security method, program, and recording medium

Saroj et al.

2015

Threshold cryptography based data security in cloud computing

US11063743B2

( en )

2021-07-13

Method of RSA signature of decryption protected using assymetric multiplicative splitting

US12124594B2

( en )

2024-10-22

Enhanced security systems and methods using a hybrid security solution

TWI597960B

( en )

2017-09-01

Key splitting

CN105339995B

( en )

2018-04-06

Decrypt device, decryption capabilities provide device, its method and recording medium

US20220060314A1

( en )

2022-02-24

Privacy preserving fully homomorphic encryption with circuit verification

Jassem et al.

2020

Enhancement of quantum key distribution protocol for data security in cloud environment

CN105763322B

( en )

2019-01-25

An obfuscated encryption key isolation digital signature method and system

US20240114025A1

( en )

2024-04-04

Modification of device behavior for use in secure networking

Syalim et al.

2011

Realizing proxy re-encryption in the symmetric world

CN114372274B

( en )

2024-12-27

A remote data backup encryption method, system, device and storage medium

CN116938468A

( en )

2023-10-24

Key generation method, device and equipment

Altarawneh

2023

A Strong Combination of Cryptographic Techniques to Secure Cloud-Hosted Data.

Pei et al.

2016

Security enhanced attribute based signcryption for private data sharing in cloud

CN109495478A

( en )

2019-03-19

A kind of distributed security communication means and system based on block chain

CN116405313A

( en )

2023-07-07

An anonymous conditional identity-based broadcast agent re-encryption method and system

Anjali et al.

2016

Design and implementation of secure cloud storage system using hybrid cryptography algorithms with role based access control model

Chen

2017

Post-Quantum Cryptography and Standardization

US20250119298A1

( en )

2025-04-10

System and method for quantum safe trust identity and authentication

US20250293877A1

( en )

2025-09-18

Quantum vault for protecting secrets against quantum computing

Xu et al.

2013

A practical deployment framework for use of attribute-based encryption in data protection

Legal Events

Date

Code

Title

Description

2023-07-19

FEPP

Fee payment procedure

Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

2023-08-04

FEPP

Fee payment procedure

Free format text : ENTITY STATUS SET TO SMALL (ORIGINAL EVENT CODE: SMAL); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

2023-09-19

STPP

Information on status: patent application and granting procedure in general

Free format text : NON FINAL ACTION MAILED

2023-12-21

STPP

Information on status: patent application and granting procedure in general

Related documents

• Generating augmented reality experiences utilizing physical objects to … — Meta Platforms Technologies, Llc (US20260037214A1)#653960
• Virtual reality system using multiple force arrays for a solver — DeepMotion, Inc. (US10657696B2)#653961
• Tracking position of device inside-out for virtual reality interactivity — Sony Interactive Entertainment America Llc (US10535153B2)#653962
• Augmented reality system with spatialized audio tied to user manipulated … — Magic Leap, Inc. (US11231770B2)#653963
• Big data-based autonomous flight drone system and autonomous flight method … — Rgblab Co., Ltd. (US20210390867A1)#653964