Group Encryption with Aggregation Functions for Scalable Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing group-oriented encryption systems face challenges in efficiently managing key distribution, user authorization, and scalability, particularly in supporting large user groups and ensuring compatibility between selection and exclusion functions, with complex key structures and high overhead in key storage and management.
Innovation Solution
A method and system for group-oriented encryption and decryption that utilize aggregation functions based on encryption modes (Select-mode and Exclude-mode) to generate and manage ciphertexts, allowing for selective and exclusive decryption by users, with a simplified key management system where each user stores only their private key and public key, and the system supports a constant-sized ciphertext and private decryption key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional 1:1 encryption systems are used for n users, then each user can have individual key control, but the total number of keys in the system reaches n2, making key management complex
Solution Approach 1:
The patent merges the key management structure from traditional 1:1 encryption by introducing a hierarchical key system where a root key and user-specific keys are combined. Each user has a unique key derived from the root key through cryptographic operations, allowing individual key control while reducing total key storage from n2 to n+1 keys in the system.
Solution Approach 2:
The root key serves multiple functions: it can encrypt messages for any user individually, generate user-specific keys, and enable broadcast encryption to multiple users simultaneously. This multi-functional design eliminates the need for separate key pairs for each user combination, significantly reducing key management complexity.
2Device complexity
If group-oriented encryption with n users is implemented, then key management is simplified to n+1 keys, but the difficulty of implementing broadcast encryption and supporting large user groups increases significantly
Solution Approach 1:
The patent implements dynamic key derivation where user keys are generated on-demand from the root key using cryptographic hash functions. This dynamic approach allows the system to support an arbitrary number of users without pre-computing and storing all possible user keys, making the system scalable and easier to implement despite the large user group requirement.
Solution Approach 2:
The root key acts as an intermediary that mediates between the system administrator and individual users. It enables the administrator to derive any user's key without knowing the user's private key, and allows users to prove their identity without exposing their private keys. This intermediary mechanism simplifies the implementation of broadcast encryption and user management.
3Reliability
If broadcast encryption is implemented to support large user groups, then secure communication to multiple users is achieved, but the ciphertext size and key length become relevant to the group scale
Solution Approach 1:
The patent extracts the user-specific information from the ciphertext by using a trapdoor mechanism. The ciphertext contains only the root key and a hash of the user's public key, rather than encrypting separately for each user. The actual user identity is extracted during decryption using the user's private key, keeping the ciphertext size constant regardless of the number of users.
Solution Approach 2:
The patent changes the dimension of key representation by using cryptographic hash functions to map user identities (arbitrary length) to fixed-length key components. This dimensional transformation allows the system to support an unlimited number of users with constant-size ciphertexts and keys, as the hash function compresses arbitrary user identifiers into fixed-length cryptographic values.
4Adaptability or versatility
If user identities are represented by arbitrary character strings, then flexibility in user identification is improved, but the complexity of key generation and verification increases
Solution Approach 1:
The patent replaces manual key generation and verification processes with cryptographic hash functions and digital signature mechanisms. User identities represented as arbitrary character strings are automatically transformed into cryptographic keys through hash functions, and verification is performed through signature validation rather than manual comparison. This substitution reduces the complexity of key generation while maintaining flexibility in identity representation.
Data Source
AI summary
A method and system for group-oriented encryption and decryption that supports the implementation of the designation and revocation functions of decryption users in a large-scale group. During the encryption, the system acquires a corresponding aggregate function according to an encryption mode; acquires any selected subset S and public parameters, and outputs an aggregate value of the subset S; generates a ciphertext of to-be-transmitted information according to the public parameters, a to-be-transmitted message and the aggregate value; acquires the encryption mode and the subset S comprised in the received ciphertext, operates the subset S and an identity of a current decryptor according to the encryption mode, and outputs a new subset S′; acquires an aggregate function corresponding to the encryption mode during the decryption; outputs an aggregate value of the new subset S′; and decrypts the received ciphertext according to the public parameters and the aggregate value, so as to obtain the to-be-transmitted information.