Group Identity Keys for Private Membership Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud providers can compromise the integrity of user groups by adding or deleting members without consent, and existing access control methods require the server to know the identity of all users, compromising user privacy.
Innovation Solution
Translate user keys to group keys, using diversified public keys to prove membership and manage group access, ensuring the cloud server only knows group keys without revealing individual identities, with group administrators controlling membership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the cloud provider directly manages group membership, then access control is simplified, but group integrity is compromised as the provider can add or delete members at will
Solution Approach 1:
The patent introduces group keys as an intermediary mechanism between the cloud provider and group members. The provider manages access control through cryptographic keys rather than direct membership management, allowing the provider to control access while the group maintains integrity through key-based authentication that cannot be arbitrarily modified by the provider
Solution Approach 2:
The system transforms the membership management approach by changing the parameter from direct user identity management to cryptographic key management. Group members are identified by group keys rather than user accounts, allowing the provider to manage access control through key distribution while preventing arbitrary membership changes
2Ease of operation
If the server stores user identities for access control, then authentication is simplified, but user privacy is compromised
Solution Approach 1:
The patent extracts user identities from the authentication process and replaces them with group keys. The server stores and manages only group keys rather than individual user identities, allowing authentication to proceed through key verification while user identity information remains excluded from server storage
Solution Approach 2:
Group keys serve as an intermediary that replaces direct user identity verification. The authentication process uses group keys as mediators between the server and users, enabling the server to verify membership without accessing or storing actual user identity information
Data Source
AI summary
Techniques are provided to create and manage groups of users. A group can be treated as a single entity. For privacy of a user, user keys can be translated to group keys, which are then used to access resources. The user can prove membership in the group via their keys (e.g., using a diversified public key), and then get the group keys in response, e.g., after verification to a group server using a diversified user key.