Re-encryption System for Secure Cloud Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage systems face security concerns when sharing data, as data is not encrypted upon uploading and downloading, relying on the trustworthiness of the cloud service, and conventional encryption methods compromise between convenience and security, either requiring key management or complex key distribution.
Innovation Solution
A re-encryption system that uses a re-encryption key to convert encrypted data between group members without decrypting it, allowing secure data sharing while maintaining encryption, and incorporates a hybrid scheme combining symmetric and public key cryptosystems for efficient key management and distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using a conventional encryption technique and shared by a group, then security is improved, but convenience is degraded due to key management complexity
Solution Approach 1:
The patent introduces a re-encryption key as an intermediary that enables the cloud server to transform ciphertext from one encryption key to another without decrypting it. This mediator mechanism allows seamless key rotation and member access management while maintaining continuous encryption, thus improving convenience without compromising security.
Solution Approach 2:
The patent segments the encryption key management into two independent parts: the original encryption key for uploading data and the re-encryption key for managing access. This segmentation allows the decryption key to remain securely stored in the client device while the re-encryption key can be managed by the cloud server, dividing the complexity and improving operational convenience.
2Ease of operation
If a decryption key is shared between group members, then ease of operation is improved, but security is worsened due to increased leakage risk
Solution Approach 1:
The re-encryption key acts as an intermediary that eliminates the need to share decryption keys among group members. Each member maintains their own private decryption key, while the cloud server holds the re-encryption key that enables it to transform ciphertext between members' encryption keys without any key sharing, thus maintaining security while improving operational ease.
Solution Approach 2:
Each group member independently manages their own encryption and decryption keys without needing to share them with others. The system enables self-service key management where members can encrypt and decrypt their own data using their personal key pairs, eliminating the security risks associated with key sharing while maintaining ease of operation.
3Ease of operation
If data is not encrypted in cloud storage, then convenience is improved, but security is worsened due to trust dependencies
Solution Approach 1:
The patent applies preliminary encryption to data before it is uploaded to the cloud server. The client device encrypts data using the member's public key before transmission, ensuring that data remains encrypted throughout its storage in the cloud. This preliminary action maintains security while allowing convenient cloud storage operations without requiring trust in the cloud provider.
4Reliability
If re-encryption processing is performed for data distribution, then security is maintained, but processing time is increased
Solution Approach 1:
The patent applies partial action by performing re-encryption only on the necessary portions of data during distribution. The cloud server selectively transforms ciphertext from the uploader's encryption key to the downloader's encryption key only when data is being accessed, rather than re-encrypting all stored data. This partial application minimizes processing time overhead while maintaining security.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A re-encryption system according to this embodiment includes a file sharing apparatus and a re-encryption apparatus. Upon receiving a file request from the client apparatus, the file sharing apparatus acquires a first encrypted file based on the file request, and transmits a re-encryption request including the first encrypted file to the re-encryption apparatus. The re-encryption apparatus re-encrypts the first encrypted file included in the re-encryption request to the second encrypted file based on the re-encryption key, and transmits the second encrypted file to the file sharing apparatus. The file sharing apparatus transmits the second encrypted file to the client apparatus. The client apparatus obtains the file by decrypting the second encrypted file based on a private key corresponding to the public key of the member.