Proxy Transformation Security via Client-Side Key Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing proxy transformation technologies fail to prevent unauthorized proxy transformation by malicious users controlling multiple servers, leading to information leakage, even when using multiple servers to distribute proxy relationships.
Innovation Solution
A method where a data owner generates a proxy key, randomizes it, and sends the randomized key to a proxy server for re-encryption, ensuring that only authorized users can decrypt the transformed information, thus preventing unauthorized proxy transformation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple servers are used to distribute proxy relationships, then security against single server compromise is improved, but the system complexity and vulnerability to coordinated attacks increase
Solution Approach 1:
The patent extracts the critical proxy relationship parameter from the server environment and keeps it exclusively on the client device. By removing the proxy relationship from server storage and replacing it with a one-time randomized proxy key, the system eliminates the need for multiple servers while maintaining security. The client device alone holds the sensitive proxy relationship, making the system simpler yet more secure against server compromise.
Solution Approach 2:
The patent performs preliminary randomization of the proxy key on the client device before transmission. The client generates a random value and uses it to create a randomized proxy key that is sent to the server only once. This preliminary action ensures that even if the server is compromised, the attacker cannot derive the original proxy relationship or perform unauthorized transformations, as the randomized key is ephemeral and cannot be reverse-engineered.
2Adaptability or versatility
If the server stores the proxy relationship, then transformation capability is improved, but unauthorized transformation by malicious users becomes possible
Solution Approach 1:
The patent introduces dynamics by making the proxy key ephemeral and randomized for each transformation operation. Instead of storing a static proxy relationship on the server, the system uses a dynamically generated randomized proxy key that is transmitted once and then discarded. This dynamic approach ensures that even if the server is compromised, the attacker cannot perform unauthorized transformations because the actual proxy relationship never resides on the server in a reusable form.
Solution Approach 2:
The patent employs a disposable randomized proxy key that is generated, transmitted, and then discarded. The randomized proxy key serves its purpose in a single transformation operation and cannot be reused or reverse-engineered. This disposable approach eliminates the security risk of storing reusable proxy relationships on servers while maintaining full transformation capability, as each key is designed to be used once and then destroyed.
3Adaptability or versatility
If the proxy key is transmitted to the server, then re-encryption capability is improved, but the risk of key compromise increases
Solution Approach 1:
The patent fundamentally changes the parameter of the proxy key by applying randomization transformation. Instead of transmitting the original proxy relationship, the system transforms it into a randomized proxy key using a random value generated on the client device. This parameter change ensures that even if the transmitted key is intercepted or the server is compromised, the attacker cannot derive the original proxy relationship or perform unauthorized transformations, as the randomization makes the key irreversibly obfuscated.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
The present invention discloses a method for performing proxy transformation between a user and a server, including: selecting a first proxy relationship between a target user and a first user from a proxy relationship library; selecting a random value, and generating a second proxy relationship according to the random value and the first proxy relationship; and encrypting original information according to the public key of the first user and the random value to obtain the encrypted information, and transmitting the encrypted information and the second proxy relationship to the server, so that the server performs proxy transformation on the encrypted information according to the second proxy relationship to obtain the transformed information. The method for performing proxy transformation thoroughly solves the security hazard that the server performs proxy transformation without user permission. The present invention further discloses a user terminal and a system for performing proxy transformation.