Decentralized Attribute-Based Encryption for Cross-Domain Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in securely sharing information across multiple security domains and authorities without requiring a centralized trusted authority, leading to complexity and increased vulnerability, especially in cross-domain information sharing scenarios.
Innovation Solution
The implementation of a decentralized Attribute-Based Encryption (ABE) system that allows independent authorities to issue mission-specific attributes and keys, enabling secure information sharing across multiple domains without a central authority, combined with Predicate-Based Encryption (PBE) to hide classification levels, ensuring secure and expressive access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized trusted authority is used to manage access control across security domains, then information sharing can be coordinated, but the system becomes vulnerable to attacks on the central authority and requires complex trust relationships
Solution Approach 1:
The patent divides the centralized authority into multiple independent Attribute-Based Encryption (ABE) authorities, each managing their own security domain. This segmentation eliminates the single point of failure while maintaining coordinated access control across domains through standardized cryptographic protocols.
2Reliability
If multiple independent authorities are used to avoid centralization, then security vulnerability is reduced, but coordination between domains becomes more complex
Solution Approach 1:
The patent implements a universal ABE framework where multiple independent authorities use the same cryptographic protocols and attribute structures. This universality allows different security domains to coordinate seamlessly without requiring domain-specific customization, simplifying cross-domain information sharing.
3Reliability
If fine-grained access control is implemented across multiple domains, then information security is improved, but the complexity of access control mechanisms increases
Solution Approach 1:
The patent replaces complex mechanical access control mechanisms (multiple access control lists, permission matrices, and authorization protocols) with cryptographic-based Attribute-Based Encryption. This substitution achieves fine-grained access control through mathematical properties rather than procedural complexity.
4Ease of operation
If classification levels are made visible for access control, then security policy enforcement is simplified, but the risk of information leakage through classification inference increases
Solution Approach 1:
The patent introduces cryptographic attributes as intermediaries that represent classification levels without exposing them. The attribute-based encryption system allows policy enforcement based on attribute matching while keeping the actual classification levels hidden within the cryptographic structure, preventing inference attacks.
Data Source
AI summary
Techniques for cryptographically secure, cross-domain information sharing are described. A first information domain including a first attribute-based encryption (ABE) authority defines a first universe of ABE attributes. Plaintext is encrypted using ABE encryption, producing ABE ciphertext. The ABE encryption uses an ABE access control expression defined with a set of ABE attributes comprising a first ABE attribute subset from the first universe of ABE attributes and second ABE attribute subset from a second universe of ABE attributes defined by a second ABE authority of a second information domain. The ABE ciphertext and the ABE access control expression are combined to produce an ABE package. The ABE package is encrypted, using predicate-based encryption (PBE), producing a PBE ciphertext. The PBE encryption uses a first set of PBE attributes from a universe of PBE attributes defined by a PBE authority.