Local encryption for single sign-on
The present disclosure describes techniques that allow for a client-side application, located on a first client device, to generate a random encryption key and encrypt locally-stored application data with the random encryption key. In order to ensure that the client-device application is unable to decrypt the locally-stored encrypted application data prior to authenticating with an external authentication source (i.e., SSO, IdP), the client-side application divides the random encryption key into at least a first share and a second share according to a secret sharing algorithm. The first share is transmitted to a trusted third party, while the second share is encrypted locally and stored in a secure location on the client device. Upon successful authentication, the trusted third party returns the second share to the first client device. The client-side application derives the random encryption key and decrypts the locally-stored encrypted application data to be used by the client-side application. By dividing the key used to encrypt the client-side application data and storing one of the secret shares necessary to deriving the key at a trusted third party, the present disclosure solves the problem of how to encrypt local application data when the login credentials for the application are managed by a trusted third party, such as an SSO system.
1. A method for securing a first encryption key, the method comprising:
receiving, by a first device, login credentials as part of a login procedure;
transmitting, by the first device, the received login credentials to a first server to be authenticated, wherein the first server is a single sign-on system;
receiving, by the first device, a result of the authentication check from the first server;
generating, by a first device, a first encryption key;
encrypting, by the first device, application data using the first encryption key;
storing the encrypted application data in a memory of the first device;
dividing, by the first device, the first encryption key into at least a first share and a second share;
transmitting, by the first device, at least one of the first share to a trusted third party;
removing, from the first device, the at least one of the first share transmitted to the trusted third party; and
storing at least one of the second share in the memory of the first device.
2. The method of claim 1 , comprising:
receiving, by the first device, a first token from the first server when the received login credentials are valid.
3. The method of claim 2 , comprising:
transmitting, from the first device, the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications;
accessing, by the first device, the one or more applications provided by the one or more second servers.
4. The method of claim 1 , comprising:
receiving, by the first device, at least one of the first share from the first server when the received login credentials are valid.
5. The method of claim 4 , comprising:
retrieving the at least one of the second share from the memory of the first device;
deriving, by the first device, the first encryption key using the first share received from the first server and the second share retrieved from the memory of the first device;
decrypting, by the first device, the application data using the derived first encryption key.
6. The method of claim 5 , comprising:
receiving, by the first device, a first token with the at least one of the first share;
transmitting, by the first device, the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications;
accessing, by the first device, the one or more applications provided by the one or more second servers using the decrypted application data.
7. The method of claim 1 , wherein dividing the first encryption key into at least a first share and a second share comprises:
generating, by the first device, a first random string, wherein the first random string is the first share;
performing, by the first device, a Boolean operation on the first encryption key using the first random string, wherein a result of the Boolean operation is the second share.
8. The method of claim 7 , wherein the Boolean operation is an XOR function.
9. The method of claim 1 , wherein the application data is a second key.
10. The method of claim 9 , further comprising: encrypting by the first device, a database using the second key.
11. A computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the computing device to:
receive login credentials as part of a login procedure;
transmit the received login credentials to a first server to be authenticated, wherein the first server is a single sign-on system;
receive a result of the authentication check from the first server;
generate a first encryption key;
encrypt application data using the first encryption key;
store the encrypted application data in a memory;
divide the first encryption key into at least a first share and a second share;
transmit at least one of the first share to a trusted third party;
remove the at least one of the first share transmitted to the trusted third party; and
store at least one of the second share in the memory.
12. The computing device of claim 11 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:
receive a first token from the first server when the received login credentials are valid;
transmit the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications; and
access the one or more applications provided by the one or more second servers.
13. The computing device of claim 11 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:
receive at least one of the first share and a first token from the first server when the received login credentials are valid;
retrieve the at least one of the second share from the memory;
derive the first encryption key using the first share received from the first server and the second share retrieved from the memory;
decrypt the application data using the derived first encryption key;
transmit the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications; and
access the one or more applications provided by the one or more second servers using the decrypted application data.
14. The computing device of claim 11 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:
generate a first random string, wherein the first random string is the first share;
perform a Boolean operation on the first encryption key using the first random string, wherein a result of the Boolean operation is the second share.
15. A non-transitory computer-readable medium comprising instructions that, when executed, perform the steps of:
receiving login credentials as part of a login procedure;
transmitting the received login credentials to a first server to be authenticated, wherein the first server is a single sign-on system;
receiving a result of the authentication check from the first server;
generating a first encryption key;
encrypting application data using the first encryption key;
storing the encrypted application data in a memory;
dividing the first encryption key into at least a first share and a second share;
transmitting at least one of the first share to a trusted third party;
removing the at least one of the first share transmitted to the trusted third party; and
storing at least one of the second share in the memory.
16. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, perform the steps of:
receiving a first token from the first server when the received login credentials are valid;
transmitting the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications; and
accessing the one or more applications provided by the one or more second servers.
17. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, perform the steps of:
receiving at least one of the first share and a first token from the first server when the received login credentials are valid;
retrieving the at least one of the second share from the memory;
deriving the first encryption key using the first share received from the first server and the second share retrieved from the memory;
decrypting the application data using the derived first encryption key;
transmitting the first token to one or more second servers, wherein the one or more second servers provide access to one or more applications; and
accessing the one or more applications provided by the one or more second servers using the decrypted application data.
18. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed, perform the steps of:
generating a first random string, wherein the first random string is the first share;
performing a Boolean operation on the first encryption key using the first random string, wherein a result of the Boolean operation is the second share.
19. The non-transitory computer-readable medium of claim 18 , wherein the Boolean operation is an XOR operation.
20. The non-transitory computer-readable medium of claim 15 , wherein the application data is a second key used to encrypt a database.