Dual Hash Chain Encryption with Proxy Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of encryption techniques has increased computational resources needed for encrypting and decrypting content, and sharing content keys can lead to unauthorized access to sensitive information, especially when encrypted content is stored in network environments.
Innovation Solution
The use of dual hash chains and proxy re-encryption techniques generates evolving content keys, where only the backward hash chain seed is accessible to the storage device, preventing unauthorized decryption, and allows fine-grained access control through credential generation and re-encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption techniques are used, then content security is maintained, but computational resources and complexity increase
Solution Approach 1:
The encryption system is segmented into two independent hash chains (forward and backward) with separate seeds. The forward hash chain is maintained by the content creator while the backward hash chain is maintained by the storage device. This segmentation allows each party to manage only the necessary components, reducing overall system complexity while maintaining security through the separation of cryptographic operations.
Solution Approach 2:
A proxy re-encryption mechanism is introduced as an intermediary between the content creator and storage device. The proxy receives encrypted content from the content creator, uses the backward hash chain values to generate re-encryption keys, and redistributes the content to authorized users. This intermediary handles the complex key management and re-encryption operations, simplifying the interactions between other system components.
2Ease of operation
If content keys are shared with content consumers, then access to encrypted content is enabled, but unauthorized access to other content increases
Solution Approach 1:
Access control is segmented through fine-grained credentials that grant access to specific content items rather than sharing master content keys. Each credential is tied to specific content and can be independently managed. This allows users to access only the specific content they are authorized for without gaining access to other encrypted content stored on the device.
Solution Approach 2:
The system uses dynamic key evolution where content keys are derived from evolving hash chain values that change over time. The backward hash chain values are periodically updated, causing the derived content keys to change dynamically. This dynamic key derivation ensures that even if a user obtains a key for current content, they cannot access previously encrypted content with different chain values.
3Productivity
If encrypted content is stored on network servers, then content distribution is enabled, but security is compromised if the server is compromised
Solution Approach 1:
The proxy re-encryption mechanism acts as a trusted intermediary between the content creator and the storage device. The proxy receives content encrypted with the content creator's key, uses the backward hash chain to generate re-encryption keys, and creates new encrypted versions for distribution. This intermediary ensures that even if the storage device is compromised, the content remains secure because the proxy controls the re-encryption process and does not store the original encryption keys.
Solution Approach 2:
The encryption architecture segments the cryptographic responsibilities: the content creator maintains the forward hash chain and original encryption keys, while the storage device maintains only the backward hash chain. This segmentation ensures that compromise of one component does not expose the other, providing security even when content is stored on network servers that could be compromised.
Data Source
AI summary
In an embodiment, content may be encrypted by a first device using a dual hash chain technique, where the first device maintains a forward hash chain and a second device maintains a backward hash chain, and content keys for encrypting content are derived using values of the forward and backward hash chains. The second device may not have knowledge of a seed used to generate the forward hash chain, and therefore may be unable to generate the content keys, reducing a likelihood that the encrypted content becomes compromised. Additionally, embodiments provide for techniques for using proxy re-encryption (PRE) to re-encrypt content, such that the encrypted content may be provided to and decrypted by a requesting device without knowledge of the forward and backward hash chains. Additionally, embodiments provide techniques for distributing encrypted content to a requesting device with fine-grained access control.