Broadcast Encryption Key Management via Prime Number Subgroups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current broadcast encryption methods face inefficiencies in managing and updating encryption keys, particularly in reducing transmission overhead, especially when dealing with a large number of users, and maintaining key security against collusion and revocation.
Innovation Solution
The method involves generating subgroups of nodes, assigning prime numbers to non-overlapping subgroups, reassigning prime numbers across layers, and using these reassigned prime numbers to generate encryption keys, which are then used to decrypt session keys, thereby reducing computation overhead and improving key management efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the Subset Difference method is used for broadcast encryption, then transmission overhead is reduced to O(2^r-1), but computation overhead and key management complexity increase
Solution Approach 1:
The patent segments the user set into multiple subsets based on user group relationships. Each user is assigned to specific subsets, and encryption keys are generated per subset rather than per individual user. This segmentation allows the system to manage keys at a coarser granularity, reducing overall key management complexity while maintaining security.
Solution Approach 2:
The patent introduces a hierarchical dimension to key management by organizing users into subsets with defined relationships. Instead of flat user-key mapping, the system creates a multi-level structure where subset identifiers and user identifiers work together to determine key assignment. This dimensional approach simplifies the management overhead.
2Reliability
If more encryption keys are managed for better security against collusion, then security improves, but transmission overhead and computation overhead increase
Solution Approach 1:
The patent applies partial action by generating encryption keys only for specific subsets that are relevant to the current broadcast, rather than managing keys for all possible user combinations. The system determines which subsets need encryption keys based on the current user set and revoked users, avoiding the excessive key management overhead while maintaining sufficient security coverage.
Solution Approach 2:
The patent changes the parameter of key generation from individual user-based to subset-based. By using subset identifiers and user identifiers as combined parameters for key generation, the system reduces the total number of keys needed while maintaining the ability to securely exclude revoked users and prevent collusion attacks.
3Productivity
If subset-based key management is implemented, then key management efficiency improves, but device complexity and storage requirements increase
Solution Approach 1:
The patent merges the subset identifier and user identifier into a combined key generation process. Instead of storing separate keys for each user-subset combination, the system uses the combination of these identifiers to derive encryption keys on-demand. This merging approach improves key management efficiency by reducing storage requirements while maintaining the ability to quickly generate appropriate keys.
Data Source
AI summary
A broadcast encryption (BE) for acquiring an encryption key which is used to decrypt a session key by a node receiving services, with less computation overhead. A plurality of subgroups, each consisting of at least one of a plurality of nodes, are generated, and layers are formed according to a number of nodes which form the subgroup. Prime numbers are assigned to the subgroups not to overlap one another, and a subgroup at an upper layer is connected with a subgroup, which includes nodes forming the subgroup of the upper layer, at a lower layer. A prime number assigned to a subgroup at an upper layer, a prime number assigned to an unconnected subgroup at the same layer, and a prime number assigned to a subgroup at a lower layer, are re-assigned to each subgroup, and an encryption key which is generated from the re-assigned prime numbers is assigned to the each group.