Policy-Based Key Sharing via Attribute Access Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large organizations, existing methods for password and key management are inefficient and insecure, requiring frequent changes and redistributions when user roles change or keys are compromised, posing security risks due to shared keys.
Innovation Solution
A policy-based key sharing method using attribute-based control, where unique user attribute keys are generated for each user based on their roles, and an access tree is constructed using Boolean algebra to govern access, minimizing disruptions and security risks by ensuring only valid keys unlock the master key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a key is compromised or user roles change, then security is maintained by changing and redistributing keys to all affected users, but this requires storing many keys and is computationally expensive
Solution Approach 1:
The patent segments the master key into multiple shares using secret sharing schemes, where each user holds a portion rather than the complete key. This allows key management operations to be performed on individual shares rather than redistributing entire keys to all users, reducing storage requirements and computational overhead while maintaining security.
Solution Approach 2:
The patent introduces a temporal dimension to key management by implementing version control and historical tracking of key shares. This allows the system to maintain multiple versions of key shares efficiently without requiring complete redistribution, as users can be assigned specific versions based on their role changes or key compromise events.
2Reliability
If keys are redistributed to all affected users when a key is compromised, then security is maintained, but this causes disruption to users and requires many keys to be stored
Solution Approach 1:
By segmenting the key into shares distributed to different users, the system allows selective regeneration of individual shares rather than requiring all users to receive new keys. When a key is compromised, only the affected share needs to be regenerated and redistributed to specific users, minimizing user disruption and reducing the number of keys that need to be stored and managed.
3Ease of operation
If the same key is shared among multiple users based on roles, then key distribution is simplified, but security risks increase
Solution Approach 1:
The patent divides the master key into multiple encrypted shares and distributes them to different users based on their roles. Each user possesses only a portion of the key material, which is useless without the other shares. This maintains the simplicity of role-based distribution while fundamentally improving security, as compromising one user's share does not expose the complete key.
Solution Approach 2:
The patent assigns different encryption properties and access permissions to different key shares based on user roles. Each user receives key shares with specific decryption capabilities tailored to their organizational role, allowing fine-grained security control while maintaining ease of distribution through automated policy-based assignment.
Data Source
AI summary
Methods of providing policy based access to master keys, enabling keys to be distributed to groups of users in a secure manner while minimizing disruptions to the user in the event of changes to group membership or changes to user attributes. User attributes are identified. Policies are rewritten in terms of user attributes. New unique user attribute keys are generated for each attribute for each user. An access tree is constructed with user attribute keys as leaf nodes and Boolean algebra operations as internal nodes. Shamir polynomials are used for AND nodes, and broadcast polynomials are used for OR nodes. Master keys are accessible by traversing the access tree from the leaf nodes to the root node constructing the polynomials attached to all the nodes along the access path.