Non-deterministic Order-Preserving Encryption for SDN Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for access control in Software Defined Networking (SDN) require a central reference monitor to have global knowledge of rules, leading to privacy concerns when outsourced, as it must learn and manage tenant information, potentially leaking sensitive data to untrusted environments.
Innovation Solution
Implementing non-deterministic order-preserving encryption (ND-OPE) with partitioned left and right sets to encrypt information, allowing operations on encrypted data without revealing tenant identities or specific information, and using cryptographic tokens for access control, ensuring privacy and flexibility in outsourcing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central reference monitor is used to orchestrate access control in SDN, then access control decisions can be made correctly, but tenant privacy is compromised due to global knowledge requirements
Solution Approach 1:
The patent segments the reference monitor functionality into multiple distributed reference monitors, each responsible for a specific subset of tenants or network resources. This segmentation allows each monitor to have limited knowledge about only its assigned tenants, thereby maintaining access control correctness while preserving tenant privacy through distributed architecture.
Solution Approach 2:
The patent introduces encrypted rule representations as intermediaries between tenants and the reference monitor. The reference monitor operates on encrypted rules without decrypting them, using cryptographic protocols to make access control decisions based on ciphertext comparisons. This intermediary encryption layer prevents the reference monitor from learning tenant information while still enabling correct access control decisions.
2Ease of operation
If the reference monitor is outsourced to cloud services, then service availability increases and costs decrease, but information leakage to untrusted environments occurs
Solution Approach 1:
The patent employs cryptographic tokens and encrypted rule representations as intermediaries that allow the outsourced reference monitor to perform access control operations without accessing plaintext tenant information. The cloud-based reference monitor receives and processes encrypted rules, making decisions based on cryptographic comparisons rather than plaintext analysis, thus enabling service outsourcing while preventing information leakage to untrusted environments.
Solution Approach 2:
The patent transforms the reference monitor's operating parameters from plaintext rules to encrypted rule representations. By changing the state of the rules from readable text to cryptographic ciphertext, the system enables outsourcing to cloud services while ensuring that even if the cloud provider accesses the data, it cannot interpret or leak meaningful tenant information.
3Loss of information
If conventional encryption is used to protect tenant information, then privacy is improved, but operations on encrypted data become inefficient
Solution Approach 1:
The patent changes the cryptographic parameters used in encryption to enable efficient operations on encrypted data. Specifically, it uses encryption schemes with structured ciphertext representations that allow comparison and access control operations to be performed directly on encrypted rules without full decryption, thereby maintaining strong privacy protection while preserving operational efficiency through cryptographic optimization.
Data Source
AI summary
A method for providing encrypted information by an information entity to one or more operating entities, the information entity having a database for storing encrypted information and the one or more operating entities being configured to operate on the encrypted information, wherein the encrypted information is stored encrypted with an encryption key known to the one or more operating entities includes performing, by an operating entity, a request on the encrypted information, wherein plaintext information to be stored encrypted is provided in tuples, each having ID information, one or more fields with field information specifying the fields, and values, wherein at least the values are encrypted with non-deterministic order preserving encryption with at least one encryption key such that each plaintext value is encrypted into a set of encrypted values, and wherein the set of encrypted values is partitioned into a left set and a right set.