Distributed Access Control Key Distribution Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems in distributed environments do not effectively manage write authorization separately from read authorization, as they rely on a single data encryption key (DEK) for both permissions, lacking a distinct scheme for managing write access.
Innovation Solution
An apparatus and method that generate and distribute separate encrypted keys for write and read authorizations using public keys, with the read authorization key being a hashed version of the write authorization key, ensuring secure and distinct access control lists are maintained and distributed among network members.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single data encryption key (DEK) is used for content encryption, then the access control system is simple to implement, but read and write authorizations cannot be separately managed
Solution Approach 1:
The patent divides the single DEK into two separate keys: a first DEK for write authorization and a second DEK for read authorization. This segmentation allows independent management of write and read permissions while maintaining relatively simple implementation through separate key generation and distribution mechanisms.
2Adaptability or versatility
If separate keys for read and write authorization are generated, then authorization management flexibility is improved, but the system complexity increases
Solution Approach 1:
The patent combines the access control list (ACL) and key distribution into a single integrated system. The ACL contains member information, authorization levels, and key references, allowing both read and write authorization management through a unified structure rather than separate systems.
Solution Approach 2:
The patent introduces a key distributor as an intermediary component that manages the generation, distribution, and security of both DEKs. This intermediary simplifies the overall system by centralizing key management functions and providing a structured approach to handling multiple keys.
3Ease of manufacture
If the read authorization key is generated by hashing the write authorization key, then key derivation is simplified, but the ability to prevent key prediction is reduced
Solution Approach 1:
The patent performs preliminary key derivation by generating the first DEK (write key) first, then deriving the second DEK (read key) through hashing. This preliminary action ensures that read authorization is always based on the previously established write key, creating a secure hierarchical key relationship.
Data Source
AI summary
An apparatus for generating a key for access control of content in a distributed environment network is provided. The apparatus includes a first key distributor configured to generate first encrypted keys by encrypting a first key corresponding to a key for write authorization using each public key of members having write authorization among members included in an access control list including information of at least one user and distribute the access control list and information about access authorization and the first encrypted keys to the members having write authorization, and a second key distributor configured to generate second encrypted keys by encrypting a second key corresponding to a key for read authorization using the first key using each public key of members having read authorization among members included in the access control list and distribute the access control list and second encrypted keys to the members having read authorization.