Scalable Symmetric Key Distribution for Publish-Subscribe Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Publish-Subscribe systems face scalability issues in securely distributing cryptographic keys to multiple subscribers, leading to high CPU and bandwidth costs, and inefficiencies in managing cached data when session keys change.
Innovation Solution
A method for securely and scalably distributing symmetric keys in Publish-Subscribe systems, where each publisher derives new keys from a unique key material and key revision, allowing efficient key regeneration and distribution, and managing cached data by re-encoding only samples outside a defined key revision window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If new secure messages are sent to each individual subscriber to establish session keys, then security is maintained, but CPU and bandwidth costs increase significantly
Solution Approach 1:
The patent segments the key establishment process into two parts: a shared group key established once for all subscribers, and individual key material distributed to each subscriber. This segmentation allows the system to maintain security through individual key material while avoiding the need to send separate secure messages to each subscriber for every key update, thereby reducing CPU and bandwidth costs.
Solution Approach 2:
The patent performs preliminary action by establishing the group key in advance and distributing key material to subscribers beforehand. When key updates are needed, the system only needs to distribute updated key material rather than establishing complete new secure channels with each subscriber, reducing the computational and bandwidth overhead of frequent key updates.
2Reliability
If all cached data samples are re-encoded when session keys change, then security is maintained, but system performance and productivity decrease
Solution Approach 1:
The patent applies local quality by selectively re-encoding only those cached data samples that are actually affected by key changes, rather than re-encoding all cached data. The system identifies and re-encodes only the specific samples that used the changed key material, leaving other samples unchanged, thereby maintaining security where needed while preserving system performance.
Solution Approach 2:
The patent implements discarding and recovering by allowing the system to discard (skip re-encoding) cached samples that are not affected by key changes, and only recover (re-encode) the specific samples that do need updating. This selective approach minimizes the performance impact of key management operations while maintaining security for affected data.
3Adaptability or versatility
If the system supports a large number of subscribers, then scalability is improved, but key distribution complexity increases
Solution Approach 1:
The patent merges the key distribution process by distributing a single group key to all subscribers simultaneously, rather than managing individual key pairs for each subscriber. This combining approach significantly reduces the complexity of key distribution in large-scale systems, as the system only needs to manage one group key and its associated key material rather than coordinating multiple individual key exchanges.
Solution Approach 2:
The patent applies universality by creating a group key that serves all subscribers simultaneously, making the key distribution mechanism universal rather than individual-specific. This multi-functional approach allows the same key distribution process to serve any number of subscribers, improving scalability without proportionally increasing complexity.
Data Source
AI summary
Unlike point-to-point request/reply systems, where data is exchanged between pairs of endpoints, in publish-subscribe systems the publisher entity may have to send data to many subscribing entities (subscribers), which can range from a handful to hundreds, thousands, or more. These systems may be used for critical applications that require security. Security requires an authentication phase where the publisher can securely identify subscribers and determine they have the necessary permissions to receive the information they send. Likewise, the subscribers need to authenticate the publishers to ensure they are entitled to produce the information they send. With this invention, a method is provided for performing secure and scalable distribution of symmetric keys from a publisher to one or more subscribers in publish-subscribe system. In addition, a method is provided for performing secure and scalable distribution of cached data samples from a publisher to one or more subscribers in a publish-subscribe system.