Hybrid Key Distribution for Encrypted Data Broadcast
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing broadcast encryption schemes face challenges in efficiently managing encryption keys over low bandwidth systems, particularly when dealing with large numbers of revoked users, as they either result in increased message size or loss of decryption capability due to packet loss, without effectively combining different key structures.
Innovation Solution
A hybrid method combining a stateless BES scheme with a binary tree key structure (KEKs No. 2) for current sessions and a stateful BES scheme with a hierarchical tree key structure (KEKs No. 1) for periodic key updates, using a function to calculate variable keys from static and dynamic keys, allowing for efficient key renewal and decryption resilience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a stateless BES scheme is used for current sessions, then users can maintain decryption capability after disconnection, but message size increases with each session to accommodate all past information
Solution Approach 1:
The patent segments the key management into two distinct schemes: a stateless scheme for current session broadcasting and a stateful scheme for periodic key updates. This segmentation allows each scheme to operate optimally within its designated function, preventing the message size explosion that would occur if all historical information were included in every broadcast.
Solution Approach 2:
The patent implements periodic key updates using the stateful scheme at predetermined intervals or when the number of revoked users reaches a threshold. This periodic action refreshes the key structure, limiting the accumulation of state information and thereby controlling message size growth while maintaining decryption reliability.
2Quantity of substance
If a stateful BES scheme is used for key updates, then message size remains controlled, but users may lose decryption capability if they miss key management packets
Solution Approach 1:
The patent performs preliminary key renewal actions by periodically updating keys with the stateful scheme before users potentially lose access. This proactive key management ensures that users have the necessary decryption keys in advance, compensating for potential packet loss during transmission.
Solution Approach 2:
The patent introduces an intermediary mechanism where the stateful scheme acts as a mediator between the broadcast system and users. It manages key state transitions and ensures key availability, bridging the gap between controlled message sizes and reliable decryption capability.
3Device complexity
If traditional single scheme is used, then system complexity is low, but effectiveness of encryption deteriorates when dealing with large numbers of revoked users on low bandwidth media
Solution Approach 1:
The patent merges two previously separate BES schemes (stateless and stateful) into a unified hybrid system. This combination allows the system to leverage the strengths of both approaches: the stateless scheme for maintaining decryption capability and the stateful scheme for controlled message sizes, thereby improving encryption effectiveness without proportionally increasing complexity.
Solution Approach 2:
The patent creates a composite encryption system that combines different key management methodologies. Like composite materials in engineering, this hybrid approach integrates components with different properties to achieve superior overall performance compared to using a single homogeneous scheme.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method for data broadcast in a system using a stateless scheme BES (A1) using a binary tree T with a KEKs N °2 key structure, for example, such as a ki,j key, associated with each difference of sub-sets Si,,j and a root key ko,-- associated with the entire tree T and a "stateful" scheme BES (A2) using the same binary tree T with a KEKs N °1 key structure, for example, such as a k, key, associated with each subset Si, where the scheme (A1) is used for the current broadcast and updating keys known by denied users with a "stateful" scheme (A2) from time to time.