Distributed Data Encryption Ramp Scheme
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud security methods fail to ensure both data confidentiality and availability, as they rely on encryption and information dispersal algorithms that do not adequately protect against leakage of information when the encryption key is compromised or when cloud servers fail.
Innovation Solution
A method that divides plaintext into blocks, encrypts them, applies a linear All-Or-Nothing scheme, transforms the ciphertext blocks differently based on the encryption key, and disperses them using an information dispersal procedure, resulting in a secure ramp scheme that maintains confidentiality even if the encryption key is leaked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional information dispersal algorithms are used to disperse data into multiple chunks, then data availability is improved (any t servers can reconstruct data), but data confidentiality deteriorates (shares leak information about the original plaintext)
Solution Approach 1:
The invention segments the encrypted data into multiple chunks using information dispersal algorithms, allowing data to be distributed across multiple servers. Any t servers can reconstruct the original data, ensuring availability while maintaining security through the cryptographic transformations applied to each segment.
Solution Approach 2:
The invention combines multiple cryptographic techniques (encryption, all-or-nothing transform, and keyed permutation) with information dispersal algorithms to create a composite security mechanism. This layered approach ensures that even if some shares are compromised, the original plaintext remains confidential as long as the threshold is not met.
2Loss of information
If encryption is applied to ensure data confidentiality, then data security is improved, but data availability deteriorates (data cannot be recovered if all ciphertext blocks are not available)
Solution Approach 1:
The invention divides the encrypted data into multiple independent ciphertext blocks that can be separately stored and transmitted. Using all-or-nothing encryption, the system ensures that any complete set of t blocks can reconstruct the original data, providing both confidentiality and availability simultaneously.
3Loss of information
If ramp schemes with two thresholds (t1, t2) are used to balance security and reconstructability, then data security is improved, but device complexity deteriorates
Solution Approach 1:
The invention uses parameterized threshold schemes where t1 and t2 can be configured based on security requirements. By changing the threshold parameters, the system can adapt to different security levels and recovery requirements without redesigning the entire system, managing complexity through flexible parameter adjustment.
Data Source
AI summary
A method for encrypting data with an encryption entity includes, in a step a), dividing a plaintext into a number of N blocks. In a step b), each of the blocks are encrypted with an encryption key resulting in a number of ciphertext blocks. In a step c), a linear All-Or-Nothing scheme is applied on the ciphertext blocks. In a step d), each of the ciphertext blocks output from step c) is transformed with a transformation procedure such that the information in different ciphertext blocks is transformed differently based on the encryption key and such that the transformation procedure is only revertable with knowledge of the encryption key. In a step e), the transformed ciphertext blocks are dispersed according to an information dispersal procedure.