Encrypted Data Distribution with Policy-Based Key Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Attribute-based Proxy Re-encryption (PRE) systems are computationally expensive and unsuitable for users with large databases or frequent sharing, particularly in lightweight IoT devices, leading to high workload costs.
Innovation Solution
A data distribution system that utilizes a key issuing device to generate public parameters and secret keys, allowing a transmitting device to encrypt data with user-defined policies, a relay device to separate and forward these policies, and a receiving device to decrypt using generated decryption keys, thereby reducing the workload on the transmitting device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Attribute-based PRE is used for data distribution, then access control and security are improved, but computational cost and workload increase significantly
Solution Approach 1:
A key issuing device is introduced as an intermediary between the data owner and data users. This mediator generates re-encryption keys based on user attributes and policies, offloading the computationally expensive key generation from both the data owner and individual users, thereby reducing their computational burden while maintaining secure attribute-based access control
Solution Approach 2:
The system segments the key generation process into distinct components: the key issuing device handles the computationally intensive re-encryption key generation, while the data owner only needs to encrypt data once. This segmentation allows the computational workload to be distributed appropriately, reducing the burden on resource-constrained devices
2Reliability
If the transmitting device generates re-encryption keys for each data sharing operation, then access control is maintained, but the workload on the transmitting device becomes extremely high
Solution Approach 1:
The key issuing device acts as a dedicated intermediary that assumes the responsibility of generating re-encryption keys. This separates the key generation function from the data transmission function, allowing the transmitting device to focus on data encryption and distribution without the overhead of repeated key generation operations
Solution Approach 2:
The key issuing device performs preliminary key generation actions by creating re-encryption keys in advance based on user attributes and access policies. These pre-generated keys are then used for subsequent data sharing operations, eliminating the need for the transmitting device to perform computationally expensive key generation for each sharing operation
Data Source
AI summary
A data distribution system that distributes an encrypted data from a transmitting device to a receiving device via a relay device with support by a key issuing device, wherein the key issuing device is configured to generate public parameters for ElGamal encryption and a secret key for attribute-based encryption, send the public parameters to the transmitting device and keep the secret key; and the transmitting device is configured to encrypt data by the public parameters, create a user defined policy for each data ID, attach the defined policy for the corresponding data ID to the encrypted data and send the encrypted data with the user defined policy to the relay device.