Multicast Group Device Authorization for Secure Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multicast group security methods, despite using group keys and message authentication codes, still face vulnerabilities where a hacked device can transmit malformed data, leading to unauthorized data publication or reception within the group.
Innovation Solution
A device in a multicast group encrypts data using a group key only when identified as an authorized publisher and decrypts data using the group key only when identified as an authorized subscriber, thereby preventing unauthorized data publication or reception.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a device in the multicast group encrypts data using a group key without verifying authorization, then data transmission efficiency is improved, but security is worsened because unauthorized devices can publish or receive data
Solution Approach 1:
The system performs preliminary authorization verification by checking whether each device is registered as an authorized publisher or subscriber before allowing encryption/decryption operations with the group key. This preliminary check prevents unauthorized devices from participating in encrypted communication while maintaining efficient data transmission for authorized devices.
Solution Approach 2:
The system introduces an intermediary authorization verification mechanism that mediates between devices and the group key usage. The broker or key management server acts as an intermediary to verify device authorization status before allowing encryption operations, ensuring security without compromising transmission efficiency for legitimate devices.
2Reliability
If the system verifies authorization before encryption/decryption operations, then security is improved, but device complexity is worsened due to additional verification steps
Solution Approach 1:
Each device maintains self-service authorization information by storing its own authorization status locally. When a device needs to perform encryption or decryption, it autonomously checks its stored authorization status without requiring complex real-time verification protocols with other devices, thus improving security while minimizing additional operational complexity.
Solution Approach 2:
The authorization verification mechanism is integrated into the existing multicast communication protocol, allowing the same infrastructure to serve both communication and security verification functions. This multi-functionality reduces overall system complexity despite adding security checks.
Data Source
AI summary
A device in a multicast group includes an encryptor/decryptor, a key storage, a security interface and a data processing requestor. The security interface performs receiving and storing a group key and a publisher key from and in the key storage when the device is registered as a publisher, and receiving and storing the group key from and in the key issuing when the device is registered as a subscriber; receiving a request for encrypting first data from the data processing requestor; determining whether the device is an authorized publisher; and transmitting the first data and the read group key to the encryptor/decryptor when the result of the determining indicates the device is the authorized publisher; receiving a first encrypted data generated by encrypting the first data using the group key; and transmitting the first encrypted data to the data processing requestor.