Metadata Encryption via Path Segmentation and Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current end-to-end encryption methods in communication networks, such as those used in social networks and messaging applications, fail to adequately secure metadata, allowing eavesdroppers to access information like message source, destination, and other details despite encrypting the message data.
Innovation Solution
The method involves establishing symmetric keys for each pair of adjacent nodes in a communication path, dividing the path into sub-paths with anchor nodes, and using secret sharing techniques to encrypt metadata, ensuring that only the source and destination nodes can decrypt the message, while intermediate nodes cannot access enough information to reveal the message's metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional Public Key Infrastructure is used for encryption, then data confidentiality is improved, but metadata remains exposed and the system requires a trusted third party
Solution Approach 1:
The patent extracts and removes the trusted third party from the encryption system by implementing end-to-end encryption where only the communicating endpoints hold keys. The system takes out the metadata exposure problem by encrypting metadata separately from data using different key mechanisms, allowing data confidentiality without requiring a central authority.
Solution Approach 2:
The patent segments the encryption process into two independent parts: data encryption using endpoint-held keys and metadata encryption using a separate mechanism. This segmentation allows data to be protected without exposing metadata, and eliminates the need for a trusted third party to manage both types of information simultaneously.
2Loss of information
If onion encryption is used for path anonymity, then metadata protection is improved, but key management becomes very cumbersome requiring keys between source and each node
Solution Approach 1:
The patent extracts the metadata from the communication path and encrypts it separately at the source endpoint using a key that never leaves the endpoint device. This removes the need for intermediate nodes to hold or manage keys for metadata protection, eliminating the cumbersome key management while maintaining metadata anonymity.
Solution Approach 2:
The patent introduces an intermediary encryption layer that processes metadata at the source endpoint before transmission. This intermediary mechanism encrypts metadata using a key derived from endpoint credentials, allowing metadata protection without requiring each intermediate node to have access to decryption keys.
3Device complexity
If each adjacent node pair shares a key for path anonymity, then path encryption is simplified, but each node is exposed to the entire path including destination
Solution Approach 1:
The patent extracts the path information from the encrypted data payload and handles it separately through a different encryption mechanism. By taking out path metadata and encrypting it independently at the source, the system maintains simple node-to-node encryption for data while protecting path confidentiality without exposing destinations to intermediate nodes.
Solution Approach 2:
The patent segments path information from data payload, encrypting path metadata separately using endpoint-held keys while using intermediate node keys only for data transmission. This segmentation ensures that intermediate nodes can simplify data encryption/decryption without gaining access to path information or destination identifiers.
Data Source
AI summary
A system and method for encrypting metadata in a communication system, including defining paths from a source node to a destination node through intermediate nodes and anchor nodes; dividing messages and sending a portion in each path by: dividing the path into sub-paths, where each two contiguous sub-paths are connected by an anchor node; calculating a secret value including a list of nodes of a first sub-path and an encrypted form of a remaining portion of the path; calculating a first random point on a linear line connecting a first metadata share of a symmetric key of the source node and a first intermediate node, and a metadata share including a second x-value of the symmetric key of the source node and the first intermediate node in the path and the secret value; and sending the portion together with the first random point to the first intermediate node.