Keyless key management system using deterministic key derivation function (KDF)

A method for secure keyless encryption key management in a multi-cloud storage environment, comprising:

• utilizing a user device to initiate a request for data encryption by receiving authentication credentials from a user, wherein the authentication credentials include a biometric marker, a time-based one-time password (TOTP), and user-specific real-time environmental data;
• generating, by a multi-factor authentication (MFA) module, a compound hash from the biometric marker, TOTP, and environmental data to verify user identity, wherein the biometric marker is processed into a cryptographic hash via a secure hashing algorithm, the TOTP is generated using a secret key associated with the user, and;
• producing, by a deterministic key derivation function (KDF) module within a secure processing environment on the user device, an encryption key dynamically on demand based on verified user-specific inputs comprising the cryptographic hash of the biometric marker, the TOTP, and the environmental data, wherein the encryption key is valid only within a predefined time window corresponding to a TOTP cycle and is discarded immediately after completion of data encryption;
• encrypting, by an encryption module on the user device, data designated for storage using the dynamically generated encryption key, without storing or retaining the encryption key post-encryption;
• splitting, by a data fragmentation module on the user device, the encrypted data into multiple data fragments based on a cryptographic fragmentation method selected from the group consisting of Shamir's Secret Sharing and Reed-Solomon coding, each data fragment containing only partial information insufficient to reconstruct the original data individually;
• distributing, by the data fragmentation module, the encrypted data fragments across multiple cloud storage providers, wherein each fragment is stored with a distinct provider, ensuring that no single provider has access to all the fragments required to reconstruct the original encrypted data;
• transmitting, by a secure communication module, the encrypted data fragments to the respective cloud storage providers over a secure communication channel using a protocol selected from the group consisting of HTTPS and TLS, wherein the communication channel is validated before transmission to prevent interception or tampering;
• retrieving, by a data retrieval module upon receiving a request for data access, the required number of encrypted data fragments from the multiple cloud storage providers and reconstructing the original encrypted data by combining the retrieved fragments, wherein the reconstruction process is verified to meet integrity requirements to ensure all fragments are present and unaltered;
• regenerating, by the KDF module on the user device, the encryption key on demand for decryption of the reconstructed encrypted data, by reapplying the same deterministic KDF with the same user-specific biometric marker, TOTP, and environmental data used in the initial encryption process;
• decrypting, by a decryption module on the user device, the reconstructed encrypted data using the regenerated encryption key, and immediately discarding the encryption key after decryption is completed to ensure it is not retained in memory or stored;
• performing, by an automated audit module, logging and tracking of each instance of encryption key generation, data access, data retrieval, and encryption key disposal in a secure ledger, providing a verifiable audit trail for compliance with data security standards, wherein the secure ledger includes metadata associated with the timing, method, and user identity of each key generation and data access event;
• updating, by the MFA module, the TOTP secret key periodically according to a preconfigured schedule to further enhance security and reduce a potential for replay attacks by ensuring that subsequent encryption keys are generated with a new TOTP sequence;
• incorporating, by the KDF module, additional real-time device-specific attributes within the environmental data, selected from the group consisting of device orientation, network connection type, and device model, to further specify the encryption key uniquely to the session and device, ensuring that only authenticated users operating in the correct context can regenerate the encryption key;
• implementing, by a security policy module, multi-factor authentication (MFA) at the initiation of the key generation process, wherein the MFA requires successful validation of the compound hash from the TOTP, biometric marker, and password before allowing the KDF to generate the encryption key;
• configuring, by the KDF module, the cryptographic hashing algorithm to provide resistance against brute-force and dictionary attacks, wherein the KDF module uses a secure cryptographic hashing algorithm selected from the group consisting of SHA-256, HMAC-SHA-512, and PBKDF2, to ensure that the encryption key is robust against unauthorized attempts to replicate or reverse-engineer the key;
• and maintaining, by a data integrity module, redundancy and integrity verification for each data fragment stored across the multiple cloud storage providers, wherein the data integrity module monitors the accessibility of each fragment and, in case of any data loss or corruption, initiates a secure retrieval protocol to fetch the fragment from an alternative cloud provider, ensuring high availability and security across the multi-cloud storage environment;
• and wherein the time-based one-time password (TOTP) is generated using a unique secret key associated with the user and synchronized with an external Network Time Protocol (NTP) server to maintain a consistent time-based sequence across distributed systems;
• and wherein the real-time environmental data includes at least one contextual identifier selected from geographic location, device identifier, IP address, ambient noise level, or any data point specific to a session environment, used to further secure the KDF-generated encryption key by anchoring it in specific environmental conditions;
• and wherein a periodic update process for the TOTP secret to increase security by rotating the secret key on a predefined schedule, thereby reducing a likelihood of replay attacks and ensuring temporal integrity for each generated encryption key.

A method for secure keyless encryption key management in a multi-cloud storage environment, comprising:

• utilizing a user device to initiate a request for data encryption by receiving authentication credentials from a user, wherein the authentication credentials include a biometric marker, a time-based one-time password (TOTP), and user-specific real-time environmental data;
• generating, by a multi-factor authentication (MFA) module, a compound hash from the biometric marker, TOTP, and environmental data to verify user identity, wherein the biometric marker is processed into a cryptographic hash via a secure hashing algorithm, the TOTP is generated using a secret key associated with the user, and;
• producing, by a deterministic key derivation function (KDF) module within a secure processing environment on the user device, an encryption key dynamically on demand based on verified user-specific inputs comprising the cryptographic hash of 6the biometric marker, the TOTP, and the environmental data, wherein the encryption key is valid only within a predefined time window corresponding to a TOTP cycle and is discarded immediately after completion of data encryption;
• encrypting, by an encryption module on the user device, data designated for storage using the dynamically generated encryption key, without storing or retaining the encryption key post-encryption;
• splitting, by a data fragmentation module on the user device, the encrypted data into multiple data fragments based on a cryptographic fragmentation method selected from the group consisting of Shamir's Secret Sharing and Reed-Solomon coding, each data fragment containing only partial information insufficient to reconstruct the original data individually;
• distributing, by the data fragmentation module, the encrypted data fragments across multiple cloud storage providers, wherein each fragment is stored with a distinct provider, ensuring that no single provider has access to all the fragments required to reconstruct the original encrypted data;
• transmitting, by a secure communication module, the encrypted data fragments to the respective cloud storage providers over a secure communication channel using a protocol selected from the group consisting of HTTPS and TLS, wherein the communication channel is validated before transmission to prevent interception or tampering;
• retrieving, by a data retrieval module upon receiving a request for data access, the required number of encrypted data fragments from the multiple cloud storage providers and reconstructing the original encrypted data by combining the retrieved fragments, wherein the reconstruction process is verified to meet integrity requirements to ensure all fragments are present and unaltered;
• regenerating, by the KDF module on the user device, the encryption key on demand for decryption of the reconstructed encrypted data, by reapplying the same deterministic KDF with the same user-specific biometric marker, TOTP, and environmental data used in the initial encryption process;
• decrypting, by a decryption module on the user device, the reconstructed encrypted data using the regenerated encryption key, and immediately discarding the encryption key after decryption is completed to ensure it is not retained in memory or stored;
• performing, by an automated audit module, logging and tracking of each instance of encryption key generation, data access, data retrieval, and encryption key disposal in a secure ledger, providing a verifiable audit trail for compliance with data security standards, wherein the secure ledger includes metadata associated with the timing, method, and user identity of each key generation and data access event;
• updating, by the MFA module, the TOTP secret key periodically according to a preconfigured schedule to further enhance security and reduce a potential for replay attacks by ensuring that subsequent encryption keys are generated with a new TOTP sequence;
• incorporating, by the KDF module, additional real-time device-specific attributes within the environmental data, selected from the group consisting of device orientation, network connection type, and device model, to further specify the encryption key uniquely to the session and device, ensuring that only authenticated users operating in the correct context can regenerate the encryption key;
• implementing, by a security policy module, multi-factor authentication (MFA) at the initiation of the key generation process, wherein the MFA requires successful validation of the compound hash from the TOTP;
• biometric marker, and password before allowing the KDF to generate the encryption key;
• configuring, by the KDF module, the cryptographic hashing algorithm to provide resistance against brute-force and dictionary attacks, wherein the KDF module uses a secure cryptographic hashing algorithm selected from the group consisting of SHA-256, HMAC-SHA-512, and PBKDF2, to ensure that the encryption key is robust against unauthorized attempts to replicate or reverse-engineer the key;
• and” maintaining, by a data integrity module, redundancy and integrity verification for each data fragment stored across the multiple cloud storage providers, wherein the data 8integrity module monitors the accessibility of each fragment and, in case of any data loss or corruption, initiates a secure retrieval protocol to fetch the fragment from an alternative cloud provider, ensuring high availability and security across the multi-cloud storage environment;
• and wherein the real-time environmental data includes at least one contextual identifier selected from geographic location, device identifier, IP address, ambient noise level, or any data point specific to a session environment, used to further secure the KDF-generated encryption key by anchoring it in specific environmental conditions;
• and wherein a periodic update process for the TOTP secret to increase security by rotating the secret key on a predefined schedule, thereby reducing a likelihood of replay attacks and ensuring temporal integrity for each generated encryption key.

A system including a processor and a memory for secure, keyless encryption key management and data storage across a multi-cloud environment, comprising:

• a user device configured to initiate encryption processes by receiving authentication credentials from a user, wherein the authentication credentials include a biometric identifier, a time-based one-time password (TOTP), and session-specific environmental data, all necessary for generating a unique encryption key without storing the key;
• “a multi-factor authentication (MFA) module operatively connected to the user device, configured to validate the user's identity through multiple verification factors, including:
• converting the biometric identifier into a cryptographic hash to secure biometric data from exposure, wherein biometric markers are selected from a group comprising fingerprint scans, facial recognition, and voiceprints, each marker converted into a cryptographic hash using a secure hashing algorithm prior to input into the KDF to provide a unique and non-reversible identifier;
• and generating the TOTP using a unique user-specific secret key synchronized with an external Network Time Protocol (NTP) server, and verifying the environmental data to ensure it matches predefined security criteria for authorized access;
• a deterministic key derivation function (KDF) module located within a secure processing environment on the user device, configured to dynamically generate an encryption key using validated authentication credentials, wherein the KDF:
• combines the cryptographic hash of the biometric identifier, the TOTP, and environmental data to produce an encryption key unique to the session, adapts encryption key parameters based on session-specific conditions, ensuring that the key is unique for each session, and discards the generated encryption key immediately after its use, ensuring that the encryption key is neither retained in memory nor stored for future use;
• an encryption module on the user device, configured to encrypt data designated for storage using the dynamically generated encryption key, wherein the encryption module encrypts the data without storing or retaining the encryption key after encryption is completed, thereby enhancing data security by preventing key reuse;
• a data fragmentation module operatively connected to the encryption module, configured to split the encrypted data object into multiple data fragments based on a cryptographic fragmentation method selected from the group consisting of Shamir's Secret Sharing and Reed-Solomon coding, wherein each data fragment contains only partial information, rendering it insufficient by itself to reconstruct the original encrypted data object;
• a multi-cloud distribution module configured to distribute the encrypted data fragments across multiple cloud storage providers, wherein each data fragment is stored with a unique provider to mitigate a risk of unauthorized access by ensuring that no single provider has access to all fragments required for data reconstruction;
• a secure communication module configured to transmit each data fragment over validated communication channels to designated cloud providers, wherein the communication channel is protected by a secure protocol selected from the group consisting of TLS and HTTPS, ensuring data integrity and confidentiality during transmission;
• a data retrieval module on the user device, configured to retrieve the necessary data fragments from the multiple cloud storage providers upon a request for data access, wherein the data retrieval module verifies the integrity of each retrieved fragment prior to reassembly to ensure that all fragments are complete and unaltered;
• a reconstruction module operatively connected to the data retrieval module, configured to reconstruct the original encrypted data object from verified fragments using the same cryptographic reassembly algorithm used for fragmentation, ensuring that a sufficient number of fragments is present for accurate reconstruction;
• the KDF module, further configured to regenerate the encryption key on demand by reapplying the deterministic KDF with the identical user-specific biometric identifier, TOTP, and environmental data used during the initial encryption, ensuring secure data access without retaining or transmitting the encryption key;
• a decryption module on the user device, configured to decrypt the reconstructed encrypted data object using the regenerated encryption key, wherein the encryption key is immediately discarded after decryption, ensuring no retention of the encryption key post-access;
• an automated audit module configured to log and track each instance of encryption key generation, data access, data retrieval, and encryption key disposal, wherein the audit module stores these records in a secure, immutable ledger to maintain a verifiable audit trail for compliance with data security standards;
• an MFA updating module configured to periodically update the TOTP secret key according to a preconfigured schedule, wherein the updated secret key ensures that each subsequent encryption key generation is unique, preventing key reuse and mitigating risks of replay attacks;
• the KDF module, further configured to incorporate additional session-specific environmental data, including device-specific attributes selected from device orientation, network connection type, and device model, thereby anchoring each encryption key to the specific device and session context, preventing unauthorized devices from generating the same encryption key;
• a security policy module configured to enforce multi-factor authentication (MFA) before key generation by the KDF, requiring successful validation of a compound hash comprising the biometric identifier, TOTP, and password, ensuring that only authenticated users can initiate the KDF;
• the KDF module, further configured to select cryptographic hashing algorithms, comprising SHA-256, HMAC-SHA-512, or PBKDF2, based on encryption strength required for the session, thereby enhancing the encryption key's robustness against brute-force and dictionary attacks;
• and a data integrity module configured to monitor availability and integrity of each data fragment stored across cloud providers, wherein the data integrity module:
• performs periodic integrity checks using cryptographic hashes to ensure each fragment is maintained without unauthorized modification, activates a failover protocol to access alternate copies of fragments in case of retrieval failures, and generates alerts for anomalies or data integrity issues detected in the storage or retrieval process, maintaining high data availability and security across the distributed storage environment;
• and wherein the time-based one-time password (TOTP) is generated using a unique secret key associated with the user and synchronized with an external Network Time Protocol (NTP) server to maintain a consistent time-based sequence across distributed systems;
• and wherein the real-time environmental data includes at least one contextual identifier selected from geographic location, device identifier, IP address, ambient noise level, or any data point specific to a session environment, used to further secure the KDF-generated encryption key by anchoring it in specific environmental conditions;
• and wherein a periodic update process for the TOTP secret to increase security by rotating the secret key on a predefined schedule, thereby reducing a likelihood of replay attacks and ensuring temporal integrity for each generated encryption key.