Abstract
This disclosure describes a method of key management for a federated custody network that holds data and AI models on behalf of depositors. Every deposit is encrypted under its own deposit key, and every copy of it, on any node, replica, backup or write-once restore vault, is encrypted under that same key. The deposit key is split into shares held by three parties: the depositor, the key vault of the custody node, and an independent key custodian. Any two shares can reconstruct the key, so the operator alone can never read a deposit. In daily operation the depositor's share is released automatically by a policy agent acting for the depositor, and only when a request matches the deposit's machine-readable terms and carries a capability issued by the custody system's regulator; if the depositor withholds its share, access stops, whatever the operator wants. Firmware in the key vault releases a reconstructed key only to an attested job enclave, only for a valid capability, and only in a permitted region. When a deposit is withdrawn, the key vault and the key custodian destroy their shares and each signs an attestation that its share no longer exists; the attestations are written to the ledger. Every copy of the deposit then becomes unreadable at once, wherever it is, including copies in write-once storage that cannot be erased. Deletion becomes something that can be proven, not merely promised.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Wang, Edward D. H., "SI Data Bank™: Depositor-Held Key Shares and Provable Deletion by Key Destruction across Every Copy in a Federated Data Custody Network", Technical Disclosure Commons, (October 13, 2026)
https://www.tdcommons.org/dpubs_series/12165