Ad Hoc Network Secret Sharing via Broadcast Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ad hoc networks face challenges in securely sharing secrets among nodes without pre-planned topology, making them vulnerable to unauthorized access and eavesdropping, especially when nodes may be compromised, which complicates key management and network security.
Innovation Solution
Implementing a bootstrapping mechanism that uses broadcast encryption and identity-based cryptographic schemes to securely distribute local area keys among nodes without revealing identity information, enabling secure communication and revocation of compromised nodes through anonymous signcryption and authenticated symmetric encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single shared key is used among all participants for encryption, then the complexity of key management is reduced, but the security is weakened because individual compromised participants cannot be excluded and the key is vulnerable to loss
Solution Approach 1:
The patent divides the single shared key into multiple individual keys, one for each participant. Each participant has their own key pair (public key and private key), allowing individual identification and independent key management. This segmentation enables selective exclusion of compromised participants while maintaining security for other participants.
Solution Approach 2:
The patent changes the key management parameter from a single shared key to multiple individual keys with different properties. Each participant's key has unique characteristics (individual public key and private key), enabling fine-grained control over access and revocation. This parameter change transforms the system from coarse-grained single-key management to fine-grained multi-key management.
2Reliability
If nodes communicate their identity information during network setup, then proper authentication and key distribution can be achieved, but the network topology becomes vulnerable to eavesdropping and unauthorized access
Solution Approach 1:
The patent introduces a trusted authority as an intermediary that issues certificates to participants. Instead of nodes directly exchanging identity information, they communicate through the trusted authority which binds identities to public keys in a secure manner. This intermediary mechanism enables authentication while protecting identity information from eavesdropping.
Solution Approach 2:
The patent performs preliminary key distribution and identity binding through certificate issuance before actual network communication begins. Participants receive their cryptographic credentials in advance from the trusted authority, establishing secure identity verification mechanisms before any sensitive network setup communications occur.
3Ease of operation
If pre-programmed credentials are used in devices to join the network, then the ease of joining is improved, but the ability to revoke compromised devices is lost
Solution Approach 1:
The patent transforms the static pre-programmed credentials into dynamic, revocable credentials. Instead of fixed credentials embedded in devices, the system uses cryptographic certificates that can be invalidated by the trusted authority. This dynamic approach allows credentials to change state from valid to revoked, enabling flexible device management.
Solution Approach 2:
The patent performs preliminary credential issuance through a trusted authority rather than hardcoding credentials in devices. This preliminary action establishes a revocation mechanism where the authority can invalidate credentials when needed, combining the ease of automatic joining with the flexibility of remote revocation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of establishing a network by sharing a secret between a first entity (A) and a second entity (B), comprising the steps of: the first entity (A) broadcasting (100) an ANNOUNCE message announcing its identity and details of other entities it is aware of, wherein each of the other entities of which it is aware is associated with a particular nonce, and the message is encrypted using a broadcast encryption scheme common to the first and second entities (A,B), and; the second entity (B), upon receiving and decrypting the ANNOUNCE message, transmitting (110) to the first entity (A) a SHARE message, wherein the SHARE message comprises a signcryption of the secret, authenticated using signcryption data associated with the particular nonce associated with the second entity (B).