Multi-Level Access Control Encryption for Ad-Hoc Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for multi-level access control in ad-hoc networks face challenges such as large key sizes, inability to add new security classes, and lack of anonymity, particularly due to reliance on discrete logarithm problems and Chinese Remainder Theorem-based solutions that require complex infrastructure and group controllers.
Innovation Solution
The method employs embedded error correcting codes, using a first public key of the highest security class and a private key from the user's security class, along with a second public key, to encrypt data, ensuring anonymity and hierarchical structure integrity by generating and decoding ciphertexts with error correction capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If discrete logarithm problem-based key distribution is used for multi-level access control, then access control functionality is achieved, but key size increases dramatically as the number of entities increases
Solution Approach 1:
The system segments the access control hierarchy into multiple security classes (SC0, SC1, SC2, etc.), where each class has its own key pair. This segmentation allows keys to remain manageable in size while still providing multi-level access control, as each entity only needs to store keys for its own security class and parent classes rather than all entities in the hierarchy.
Solution Approach 2:
The patent introduces a hierarchical dimension to the key distribution system, organizing entities into security classes with parent-child relationships. This dimensional organization allows efficient key management where key size does not grow with the total number of entities, but rather with the depth of the hierarchy, resolving the contradiction between access control reliability and key size.
2Reliability
If discrete logarithm problem-based encryption is used, then access control is implemented, but new security classes cannot be added to the hierarchy
Solution Approach 1:
The system employs dynamic key generation where each security class can independently generate its own key pair. When new security classes need to be added to the hierarchy, they simply generate new keys following the same protocol, making the system adaptable and flexible without requiring reconfiguration of existing entities or complex infrastructure changes.
3Reliability
If Chinese Remainder Theorem-based encryption with public key infrastructure is used, then hierarchical structure can be hidden and anonymity supported, but complex infrastructure and group controllers are required
Solution Approach 1:
Each security class autonomously generates its own public and private keys without requiring a central authority or group controller. The hierarchical structure is naturally hidden through the key generation and encryption process, where entities encrypt data for their parent security class using the parent's public key. This self-service approach achieves anonymity and structure hiding while eliminating the need for complex PKI infrastructure.
4Reliability
If conventional multi-level access control is used, then access control is achieved, but anonymity is not supported as users must publish their ID with encrypted information
Solution Approach 1:
The patent extracts the identifier information from the encrypted data structure, placing it separately in the header portion of the ciphertext. The actual encrypted payload contains only the encrypted message and authentication tags, not the user ID. This separation allows the system to maintain access control through hierarchical key relationships while preserving user anonymity in the encrypted data itself.
Data Source
AI summary
An encryption method for encrypting data for multi-level access control in an ad-hoc network including hierarchical security classes includes encoding data into a predetermined code using a first public key of a highest security class, adding a private key of a security class to which a user belongs, to the predetermined code, and generating a ciphertext by adding a second public key, published by the security class to which the user belongs, to the addition result. A corresponding decryption method includes subtracting the private key from the ciphertext, performing a first decoding using a secret key known by a security class, to which a receiver belongs, by the receiver of the ciphertext, and correcting errors included in the second public key and detecting the data by performing a second decoding of the result of the first decoding using a code known by the security class to which the receiver belongs.