Group Communication Key Rotation for Malicious User Exclusion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 3GPP standard for critical communication networks faces challenges in efficiently revoking Identity-Based Encryption (IBE) key pairs due to the public key being derived from the identity of the private key holder, leading to difficulties in excluding malicious users without disrupting communication services.
Innovation Solution
A method and key management server for securely managing symmetric encryption keys, allowing for the revocation of compromised keys by generating a new symmetric encryption key for all users except the malicious user, ensuring seamless communication continuity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If IBE asymmetric encryption key pairs are used in 3GPP standard, then authentication and key distribution are simplified, but key revocation becomes difficult and service disruption occurs when malicious users need to be excluded
Solution Approach 1:
The system segments key management into two independent parts: IBE asymmetric key pairs for initial authentication and symmetric encryption keys for actual group communication. This segmentation allows the symmetric keys to be independently revoked and redistributed without affecting the underlying IBE infrastructure, thus enabling easy key revocation while maintaining the authentication benefits of IBE.
Solution Approach 2:
A Key Management Server (KMS) is introduced as an intermediary between the authentication system and group communication. The KMS receives exclusion requests, generates new symmetric encryption keys, and distributes them to authorized users. This intermediary enables centralized control over key distribution and revocation, solving the key revocation difficulty while preserving the simplified authentication of IBE.
2Reliability
If symmetric encryption keys are redistributed to all users except the malicious one, then communication security is maintained, but service disruption occurs during key changes
Solution Approach 1:
The system performs preliminary key generation and preparation before the exclusion takes effect. The Key Management Server generates new symmetric encryption keys in advance and has them ready for immediate distribution when an exclusion request is received. This preliminary preparation minimizes the time window during which service disruption occurs, as the new keys can be rapidly distributed to maintain communication security.
Solution Approach 2:
The system ensures continuous group communication by maintaining the group communication session while only revoking the specific user's access. The symmetric encryption keys are redistributed to remaining members without terminating the overall communication session, allowing useful action (group communication) to continue uninterrupted while excluding the malicious user.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for managing a user (13) in a group communication, said group communication comprising a plurality of other users (11), the user (13) and the plurality of other users (11) being able to communicate securely with each other in said group communication using a symmetric encryption key (KS). The management method includes a step (E5) of receiving an exclusion request (ReqExclu) from the user (13), said user to be excluded, and a step (E8) of transmitting to the other users (11) a new symmetric encryption key (New KS) and a notification (I-message) for the use of said new symmetric encryption key (New KS) in place of the symmetric encryption key (KS) used before receiving the exclusion request from user (13).