Zero-knowledge architecture between multiple systems
Examples of the present disclosure describe systems and methods relating to a zero-knowledge architecture between multiple systems. In an example, multiple systems may provide an application. User data of the application may be encrypted using a cryptographic key to restrict access to the user data. In some examples, the cryptographic key may not be provided to the multiple systems, thereby providing a zero-knowledge architecture. In order to ensure a user may access the cryptographic key, the cryptographic key may be encrypted using a second cryptographic key. The encrypted representation of the cryptographic key may be provided to a first system, while the second cryptographic key may be provided to a second system. As a result, a user computing device may retrieve both the encrypted representation of the cryptographic key and the second cryptographic key from the first and second systems, respectively, in order to encrypt/decrypt user data.
1. A system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the system to perform a set of operations, the set of operations comprising:
generating, at a computing device, a first cryptographic key and a second cryptographic key;
encrypting the first cryptographic key using the second cryptographic key to generate a third cryptographic key;
transmitting the second cryptographic key to a first system and the third cryptographic key to a second system;
generating encrypted user data using the first cryptographic key;
based on determining to decrypt the encrypted user data, accessing the third cryptographic key and the second cryptographic key;
generating a decrypted first cryptographic key by decrypting the third cryptographic key using the second cryptographic key; and
decrypting at least a part of the encrypted user data using the decrypted first cryptographic key.
2. The system of claim 1 , wherein the first cryptographic key is not retained by the computing device, and wherein accessing the third cryptographic key and the second cryptographic key comprises:
communicating with the second system to retrieve the third cryptographic key; and
communicating with the first system to retrieve the second cryptographic key.
3. The system of claim 2 , wherein communicating with the second system comprises authenticating a user of the computing device with the second system.
4. The system of claim 2 , wherein communicating with the first system comprises authenticating with the first system.
5. The system of claim 1 , wherein at least one of the second cryptographic key and the third cryptographic key are accessed at the computing device.
6. The system of claim 1 , wherein the set of operations further comprises:
transmitting at least a part of the encrypted user data to at least one of the first system and the second system.
7. The system of claim 6 , wherein decrypting at least a part of the encrypted user data comprises accessing the encrypted user data from at least one of the first system and the second system.
8. A method for decrypting encrypted user data for an application, comprising:
authenticating with a first system;
receiving, at a computing device, a first cryptographic key from the first system;
authenticating with a second system;
receiving a second cryptographic key from the second system;
accessing encrypted user data associated with the application;
decrypting the first cryptographic key using the second cryptographic key to generate a decrypted cryptographic key; and
decrypting the encrypted user data using the decrypted cryptographic key.
9. The method of claim 8 , wherein the encrypted user data is accessed from at least one of the first system and the second system.
10. The method of claim 8 , wherein authenticating with the first system comprises using a different authentication mechanism than authenticating with the second system.
11. The method of claim 8 , further comprising:
retaining at least one of the first cryptographic key and the second cryptographic key at the computing device.
12. The method of claim 8 , further comprising:
authenticating with a third system;
receiving a third cryptographic key from the third system; and
further decrypting the decrypted cryptographic key using the third cryptographic key.
13. The method of claim 8 , further comprising:
generating additional encrypted user data, wherein the additional encrypted user data is encrypted using the decrypted cryptographic key; and
transmitting at least a part of the additional encrypted data to at least one of the first system and the second system.
14. A method for initializing an application provided by at least a first system and a second system, comprising:
generating, at a computing device, a first cryptographic key and a second cryptographic key;
encrypting the first cryptographic key using the second cryptographic key to generate a third cryptographic key;
transmitting the second cryptographic key to the first system and the third cryptographic key to the second system;
generating encrypted user data using the first cryptographic key;
based on determining to decrypt the encrypted user data, accessing the third cryptographic key and the second cryptographic key;
generating a decrypted first cryptographic key by decrypting the third cryptographic key using the second cryptographic key; and
decrypting at least a part of the encrypted user data using the decrypted first cryptographic key.
15. The method of claim 14 , wherein the first cryptographic key is not retained by the computing device, and wherein accessing the third cryptographic key and the second cryptographic key comprises:
communicating with the second system to retrieve the third cryptographic key; and
communicating with the first system to retrieve the second cryptographic key.
16. The method of claim 15 , wherein communicating with the second system comprises authenticating a user of the computing device with the second system.
17. The method of claim 15 , wherein communicating with the first system comprises authenticating with the first system.
18. The method of claim 14 , wherein at least one of the second cryptographic key and the third cryptographic key are accessed at the computing device.
19. The method of claim 14 , further comprising transmitting at least a part of the encrypted user data to at least one of the first system and the second system.
20. The method of claim 19 , wherein decrypting at least a part of the encrypted user data comprises accessing the encrypted user data from at least one of the first system and the second system.