Identity-Based Key Encryption for Distributed Node Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods lack granular control over private key access in distributed networks, where a single key is often required for decryption, posing challenges in managing access permissions across multiple nodes.
Innovation Solution
Implementing identity-based broadcast encryption and revocation encryption to assign multiple identities to each server, splitting the key encryption key into pieces and encrypting them using specific algorithms, allowing only authorized servers to decrypt the private key based on location and identifier configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single private key is used for decryption across multiple nodes, then decryption simplicity is improved, but access control granularity deteriorates
Solution Approach 1:
The private key is segmented into multiple key shares that are distributed across different nodes. Each node holds a portion of the key material, and a threshold number of nodes must collaborate to reconstruct and use the private key. This segmentation enables fine-grained access control while maintaining cryptographic security.
Solution Approach 2:
The patent implements a nested structure where the private key is first split into key shares, then each key share is further protected by additional encryption layers and access policies. Multiple levels of encryption and authorization are nested within each other to create a hierarchical access control system.
2Adaptability or versatility
If multiple key pieces are distributed across nodes, then access control granularity is improved, but key management complexity deteriorates
Solution Approach 1:
A key management service or intermediary component is introduced to handle the complexity of key distribution, storage, and retrieval. This intermediary manages the key shares, tracks which nodes hold which shares, and coordinates the reconstruction process when key usage is required, thereby reducing the burden on individual nodes.
Solution Approach 2:
The patent designs a universal key management framework that can handle multiple types of keys, multiple access policies, and various node configurations through a single standardized system. This multi-functional approach reduces overall system complexity by providing a unified solution rather than separate mechanisms for each scenario.
3Measurement precision
If identity-based encryption is implemented with multiple identities per server, then access permission precision is improved, but encryption algorithm complexity deteriorates
Solution Approach 1:
Each server is assigned multiple identities with different access permissions for different key shares or key reconstruction scenarios. The identity-based encryption system allows each server to present the appropriate identity based on the specific operation required, enabling precise access control tailored to local needs while maintaining a unified cryptographic framework.
Data Source
AI summary
Managing private key access in multiple nodes is described. A piece of data (e.g., a private key) is encrypted using identity-based broadcast encryption and identity-based revocation encryption so that only certain servers in a distributed network of servers can decrypt the piece of data. The piece of data is encrypted with a key encryption key (KEK). The KEK is split into two pieces. The first piece is encrypted using identity-based broadcast encryption with a first set of identities as input such that only servers of the first set of identities can decrypt the first piece, and the second piece is encrypted using identity-based revocation encryption so that all servers except those that have the second set of identities can decrypt the second piece. The keys are transmitted to the servers.