Proxy Re-Encryption Key Update Without Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In file encryption systems, the continuous use of the same cryptographic key leads to deterioration of cipher strength, and existing methods for updating encryption keys, such as regenerating and re-encrypting data, are inefficient and can result in unnecessary operations and information leakage.
Innovation Solution
A data storage apparatus that removes revocation information from decryption conditions while keeping encrypted data encrypted, allowing for re-encryption using a proxy re-encryption scheme, thereby updating encryption keys without decrypting the data and maintaining cryptographic performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all encrypted data is decrypted and re-encrypted with new key pairs, then the cipher strength is maintained, but security is compromised and processing time and cost increase significantly
Solution Approach 1:
The patent introduces a re-encryption key as an intermediary that enables key pair updates without decrypting the original encrypted data. The re-encryption key acts as a mediator between the old and new key pairs, allowing the encrypted data to be transformed to work with new key pairs while maintaining security throughout the process.
2Reliability
If all encrypted data is decrypted and re-encrypted with new key pairs, then the cipher strength is maintained, but processing time increases greatly
Solution Approach 1:
The re-encryption key serves as a time-saving intermediary that enables efficient key updates. Instead of performing time-consuming decryption and re-encryption operations, the system uses the re-encryption key to directly transform the encrypted data representation, significantly reducing processing time while maintaining security.
3Reliability
If revocation information is retained in decryption conditions, then access control is maintained, but cryptographic performance deteriorates due to unnecessary operations
Solution Approach 1:
The patent extracts and removes revocation information from decryption conditions during the re-encryption process. By separating the access control requirements from the cryptographic operations, the system eliminates unnecessary computational overhead while preserving the essential access control functionality through updated decryption conditions.
4Reliability
If decryption and re-encryption is performed for all data, then key updates are achieved, but processing cost becomes extremely high
Solution Approach 1:
The re-encryption key acts as a cost-effective intermediary that enables key updates without the high processing costs associated with full decryption and re-encryption. This intermediary approach dramatically reduces computational resources and energy consumption while achieving the same key update objective.
Data Source
AI summary
A data storage unit (202) stores encrypted data while remaining in an encrypted state, and stores decryption conditions to define a user attribute of a decryption-permission user who is permitted to decrypt the encrypted data. In a case wherein revocation information to indicate a user attribute of a revoked user who is no longer the decryption-permission user has been added to the decryption condition when update timing arrives, a revocation information removing unit (206) removes the revocation information from the decryption condition while the encrypted data remains in the encrypted state. Further, the revocation information removing unit (206) transmits the encrypted data and the decryption conditions from which the revocation information has been removed to a re-encryption apparatus that performs re-encryption in a proxy re-encryption scheme, and receives, from the re-encryption apparatus, the encrypted data that has be re-encrypted in the proxy re-encryption scheme using the decryption condition from which the revocation information has been removed. A refresh processing unit (205) updates the encrypted data that has been re-encrypted and the decryption condition from which the revocation information has been removed.