Policy-Hiding Public Key Encryption for Cloud Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional encryption schemes fail to ensure data confidentiality and private access control in untrusted environments, such as cloud computing, as they require clear text policies and are resource-intensive for encryption and decryption, leading to potential data leakage and inefficiencies.

Innovation Solution

A method and system for generating a public key/secret key pair based on predefined policy and attribute information, where the public key hides policy information and the secret key is generated with attribute information, enabling secure encryption and decryption without revealing policy details, thus maintaining confidentiality and flexibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional encryption schemes are used to encrypt data in cloud environments, then data confidentiality is improved, but computational resources and time are excessively consumed

Engineering Contradiction:

Improvedata confidentialityVSAvoidcomputational efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The encryption system is segmented into two distinct components: public keys that are freely distributable and contain policy information, and secret keys that are privately held and contain attribute information. This segmentation allows encryption operations to use only public keys (high efficiency) while decryption and access control use secret keys (high security), resolving the contradiction between confidentiality and computational efficiency

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Policy information is pre-encoded into the public key structure during key generation, and attribute information is pre-encoded into the secret key structure. This preliminary action eliminates the need for repeated policy evaluation and attribute matching during encryption/decryption operations, significantly reducing computational overhead while maintaining security

Inventive Principle:

Principle #10Preliminary action

2Ease of operation

If clear text policies are used for access control, then access enforcement is simplified, but policy information leaks to adversaries

Engineering Contradiction:

Improveaccess control enforcementVSAvoidpolicy confidentiality

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The system uses asymmetric key structures where public keys contain policy information in an encrypted/encoded form that is mathematically one-way, and secret keys contain attribute information in a corresponding encoded form. This asymmetry allows access control to be enforced through cryptographic operations on the encoded forms without ever exposing the actual policy or attribute values, maintaining both ease of enforcement and confidentiality

Inventive Principle:

Principle #4Asymmetry

Solution Approach 2:

The policy and attribute information are transformed from clear text parameters into cryptographic parameters through the key generation process. The policy information becomes part of the public key's mathematical structure, and attribute information becomes part of the secret key's mathematical structure, changing the parameter representation from human-readable text to cryptographic values that preserve functionality while ensuring confidentiality

Inventive Principle:

Principle #35Parameter changes

3Reliability

If functional encryption schemes are used to handle access policies, then policy privacy is improved, but clear text policies are still required as input

Engineering Contradiction:

Improvepolicy privacyVSAvoidpolicy exposure

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

Instead of taking clear text policies as input and producing encrypted access decisions, the system inverts the approach by taking encoded policy information (in public keys) and encoded attribute information (in secret keys) as inputs, and producing cryptographic proofs of access authorization. This inversion eliminates the need for clear text policy exposure while maintaining policy privacy throughout the entire access control process

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS9256763B2Method and system for providing a public key/secret key pair for encrypting and decrypting data

Publication Date: 2016.02.09 NEC CORP

AI summary

A method for providing a public key/secret key pair for encrypting and decrypting data, wherein the public key of the public key/secret key pair and a master secret key are generated based on predefined policy information, and wherein the secret key of the public key/secret key pair is generated based on the generated master secret key and predefined attribute information. A method for accessing a system in an untrusted environment and a system for providing a public key/secret key pair for encrypting and decrypting data as well as a use for access control are also described.