Group-Based Encryption in Enterprise Fabric Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise fabric networks face challenges in maintaining data confidentiality and secure communication across different user groups, especially when data is encrypted, due to the increasing number of endpoint devices and complex group-based policies.
Innovation Solution
A method is implemented in fabric networks to generate a shared secret specific to source-group/destination-group pairs using public and private keys, ensuring secure encryption and transmission of data without compromising communication if the shared secret is discovered, by employing a Diffie-Hellman key exchange and LISP signaling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted irrespective of user group, then data confidentiality is maintained, but computational processing overhead increases and secure communication within user groups becomes challenging
Solution Approach 1:
The patent segments the encryption approach by user groups, generating distinct shared secrets for each source-destination user group pair rather than using a single universal encryption key. This allows encryption to be applied selectively based on user group relationships, maintaining confidentiality while reducing computational overhead for communications within the same user group.
Solution Approach 2:
The patent implements local quality by applying different encryption characteristics to different user group interactions. Each user group pair has its own shared secret, allowing the system to tailor security measures to specific communication needs. This enables more efficient processing for local user group communications while maintaining strong security for cross-group communications.
2Reliability
If granular encryption is implemented for each user group pair, then security is enhanced, but device complexity and key management become more challenging
Solution Approach 1:
The patent implements self-service by enabling user groups to autonomously generate and manage their own shared secrets through the Diffie-Hellman key exchange protocol. Each user group independently performs key generation and exchange operations without requiring centralized key management infrastructure, thereby enhancing security while avoiding the complexity of centralized key distribution systems.
3Reliability
If a shared secret is used for encryption between user groups, then secure communication is achieved, but the system becomes vulnerable if the shared secret is discovered
Solution Approach 1:
The patent segments the cryptographic space by creating unique shared secrets for each source-destination user group pair. This segmentation ensures that if one shared secret is compromised, the security of other user group communications remains intact. The Diffie-Hellman protocol further enhances this by allowing each pair to independently generate their own cryptographic parameters, isolating the impact of any single secret discovery.
Data Source
AI summary
In accordance with various implementations, a method is performed at a source node of a fabric network coupled to a plurality of hosts respectively associated with a plurality of group identifiers. The method includes generating a source public key based on a source private key, a source group identifier of the plurality of group identifiers, and a destination group identifier of the plurality of group identifiers. The method includes sending, from the source node coupled to at least one host associated with the source group identifier to a destination node coupled to at least one host associated with the destination group identifier, the source public key. The method includes receiving, at the source node from the destination node, a destination public key based on a destination private key, the source group identifier, and the destination group identifier. The method further includes generating a shared secret based on the destination public key and the source private key.