Custodian securing a secret of a user
Methods, systems and apparatuses for a custodian securing a secret are disclosed. One method includes receiving, by a custodian server of a first custodian, encrypted shares, wherein the encrypted share are generated based on a secret of the user, a policy, and a plurality of public keys, comprising generating a plurality of shares from the secret, and encrypting each share utilizing a corresponding one of the plurality of public keys. The method further includes verifying, by the custodian server, that the encrypted shares can be used to reconstitute the secret upon receiving the encrypted shares, comprising leveraging, by the first custodian, one-way cryptographic functions, wherein the first custodian can reconstruct the secret, but cannot obtain access to the secret or any of the shares.
1. A method of a custodian securing a secret of a user, comprising:
receiving, by a custodian server of a first custodian, encrypted shares, wherein the encrypted share are generated based on a secret of the user, a policy, and a plurality of public keys, comprising generating a plurality of shares from the secret, and encrypting each share utilizing a corresponding one of the plurality of public keys; and
verifying, by the custodian server, that the encrypted shares can be used to reconstitute the secret upon receiving the encrypted shares, comprising leveraging, by the first custodian, one-way cryptographic functions, wherein the first custodian can reconstruct the secret, but cannot obtain access to the secret or any of the shares.
2. The method of claim 1 , further comprising a plurality of adjudicators, wherein each of the plurality of public keys has a corresponding at least one adjudicator of the plurality of adjudicators, and a corresponding secret key.
3. The method of claim 1 , further comprising escrowing the corresponding secret key of one or more of the plurality of public keys.
4. The method of claim 3 , further comprising generating, encrypted shares based on the corresponding secret key, a policy, and a plurality of public keys, and providing the encrypted shares to a second custodian.
5. The method of claim 3 , wherein escrowing the corresponding secret key comprises:
generating, encrypted shares based on the corresponding secret key, a policy, and a plurality of public keys;
splitting the encrypted shares; and
providing the split encrypted shares between more than one custodian.
6. The method of claim 4 , wherein the first custodian and the second custodian are part of a common network.
7. The method of claim 2 , further comprising monitoring a loss of one or more of the plurality adjudicators.
8. The method of claim 1 , wherein generating the encrypted shares based on the secret, a policy, and one or more public keys, is performed within a trust boundary.
9. The method of claim 1 , wherein the first custodian comprises a cloud network.
10. The method of claim 1 , wherein verifying, by the first custodian, that the encrypted shares can be used to reconstitute the secret is based upon the encrypted shares received by the first custodian, the public keys and the policy.
11. The method of claim 1 , wherein approved parties can decrypt the shares, wherein approved parties comprise parties who have access to the encrypted shares.
12. The method of claim 1 , wherein approved parties can decrypt the shares, wherein approved parties comprise parties who have secret keys that can decrypt the encrypted shares.
13. The method of claim 1 , wherein the first custodian receives the encrypted shares, but cannot decrypt the secret shares.
14. A method of a custodian server securing a secret of a user, comprising:
receiving, by a custodian server of a first custodian, encrypted shares, wherein the encrypted share are generated based on a secret of the user, a policy, and a plurality of public keys, comprising generating a plurality of shares from the secret, and encrypting each share utilizing a corresponding one of the plurality of public keys; and
verifying, by the custodian server, that the encrypted shares can be used to reconstitute the secret upon receiving the encrypted shares;
wherein each of the plurality of public keys has a corresponding at least one adjudicator of a plurality of adjudicators, and a corresponding secret key; and
further comprising monitoring a loss of one or more of the plurality adjudicators; and
providing the user with an early warning if the loss of adjudicators exceeds a threshold, thereby allowing the user to select new or different adjudicators.
15. A custodian server of a custodian operative to:
receive encrypted shares, wherein the encrypted share are generated based on a secret of the user, a policy, and a plurality of public keys, and wherein a plurality of shares are generated from the secret, and each share is encrypted utilizing a corresponding one of the plurality of public keys; and
verify that the encrypted shares can be used to reconstitute the secret upon receiving the encrypted shares, comprising leveraging, by the custodian, one-way cryptographic functions, wherein the custodian can reconstruct the secret, but cannot obtain access to the secret or any of the shares.
16. The custodian server of claim 15 , wherein the custodian comprises a cloud network.
17. The custodian server of claim 15 , wherein the custodian server being operative to verify that the encrypted shares can be used to reconstitute the secret is based upon the encrypted shares received by the custodian, the public keys and the policy.