Identity-Based Encryption Key Server Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing identity-based encryption systems for large numbers of external users is burdensome for organizations maintaining their own private key generators, as they need to handle millions of key requests efficiently while ensuring security and authenticity.
Innovation Solution
Implementing a system with a local domain name system server and a local IBE key server within the organization, along with a public IBE key server, where an identical master secret is maintained at both servers, allowing internal users to use the local key server and external users to use the public key server for cryptographic operations, thereby distributing the workload and maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an organization maintains its own IBE private key generator to control security and authentication, then security and authenticity are improved, but the burden of handling millions of key requests increases
Solution Approach 1:
The system segments the IBE key generation service into two separate servers: a local IBE private key generator for internal users and a remote IBE private key generator for external users. This segmentation allows the organization to maintain security control internally while offloading the burden of handling millions of external key requests to a remote service, thereby resolving the contradiction between security maintenance and request handling capacity
Solution Approach 2:
The patent introduces a remote IBE private key generator as an intermediary service that external users access through a web browser. This intermediary handles the bulk of external key requests externally, reducing the load on the organization's internal key generator while maintaining security control through the master secret that remains with the organization
2Adaptability or versatility
If a local IBE key server is used for all users, then control over security is maintained, but the system cannot efficiently support large numbers of external users
Solution Approach 1:
The system applies local quality by providing different key generation services to different user groups: internal users access the local IBE private key generator for security-critical operations, while external users access the remote IBE private key generator for convenience. This differentiation allows the system to maintain security control for internal operations while adapting to support large numbers of external users
Data Source
AI summary
A system is provided that uses identity-based encryption (IBE) to allow a sender to securely convey information in a message to a recipient. A service name such as a universal resource locator based at least partly on the name of an organization may be associated with a local key server at the organization and a public key server external to the organization. Users at the organization may use the service name to access the local key server to obtain IBE public parameter information for performing message encryption and to obtain IBE private keys for message decryption. External to the organization, users may obtain IBE public parameter information and IBE private keys from the public key server using the same service name. The local key generator and the public key generator may maintain identical copies of the same IBE master secret.