Authenticated Key Rotation Using Homomorphic Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in key management, computational efficiency, and cybersecurity vulnerabilities during key rotation and MAC verification, particularly due to exposure of plaintext data during decryption and re-encryption processes.
Innovation Solution
A privacy-preserving authenticated key rotation method using homomorphic encryption and MAC verification, which encrypts and re-encrypts data without decrypting it, allowing for authentication and verification of data integrity post-key rotation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key rotation is performed by decrypting and re-encrypting data, then key management can be updated, but plaintext data is exposed to cybersecurity risks during the process
Solution Approach 1:
The patent introduces a re-encryption key as an intermediary that enables direct transformation from old ciphertext to new ciphertext without plaintext exposure. This mediator allows the key rotation process to occur entirely in the encrypted domain, eliminating the harmful exposure of plaintext data while maintaining authentication through MAC verification
Solution Approach 2:
The patent replaces the traditional mechanical key rotation process (decrypt→process→encrypt) with a homomorphic re-encryption mechanism that operates directly on ciphertext. This substitution eliminates the need to expose plaintext during key rotation, achieving both security and functionality
2Object-affected harmful factors
If data is encrypted and stored, then data privacy is protected, but verification of data integrity becomes complex during key rotation
Solution Approach 1:
The patent merges the MAC (message authentication code) and encryption operations into a unified homomorphic framework. The MAC is computed over the ciphertext rather than the plaintext, and the verification process operates entirely on encrypted data, combining authentication and encryption into a single coherent system that maintains privacy while simplifying verification
Solution Approach 2:
The patent implements a feedback mechanism where the MAC verification result is obtained before completing the re-encryption process. This feedback allows the system to verify data integrity at intermediate stages and only proceed with key rotation if authentication succeeds, reducing overall complexity by enabling early validation
Data Source
AI summary
Certain aspects of the disclosure provide a method for performing data verification. The method includes generating a MAC by applying a tagging algorithm indicated by a shared verification key to a data item; appending the MAC to the data item; generating an encrypted dataset comprising an encrypted data item and encrypted message authentication; generating a re-encryption key based on a homomorphic secret key corresponding to the homomorphic public key and a new public key; generating a re-encrypted dataset comprising a re-encrypted data item and a re-encrypted MAC; transmitting the re-encrypted dataset to a first external system configured to perform data verification; receiving, from the first external system, an encrypted verification result based on the shared verification key; and taking an action based on receiving the verification result indicating that the data item is authentic.