Secret Sharing for Information-Theoretic Secure Interconnection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN solutions rely on computational security, which can be vulnerable to attacks and requires trusted authorities for key management, and they do not provide information-theoretically secure communication over multipath networks.
Innovation Solution
A method using a secret sharing scheme to create n shares of data, where only k shares are required to decrypt the information, ensuring that no intermediate node intercepts k or more shares, and implementing this scheme across various communication layers to establish a fully private and information-theoretically secure interconnection over public infrastructure networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key infrastructure is used for secure communication, then authentication and key management are provided, but vulnerability to man-in-the-middle attacks and dependency on trusted authorities occur
Solution Approach 1:
The patent segments the secret into multiple shares using secret sharing schemes, distributing them across different paths. This eliminates the need for a single trusted authority to hold the complete key, thereby preventing man-in-the-middle attacks where an attacker could intercept a single centralized key.
Solution Approach 2:
The patent introduces untrusted intermediaries (network nodes) that merely forward shares without being able to reconstruct the secret. These intermediaries act as mediators that enable communication while their inability to access the complete secret protects against man-in-the-middle attacks.
2Reliability
If encryption key length is increased to maintain security against computational attacks, then security level is improved, but encryption performance degrades
Solution Approach 1:
The patent replaces computational security mechanisms (long encryption keys requiring heavy cryptographic processing) with information-theoretic security mechanisms (secret sharing). This substitution eliminates the need for long keys and complex encryption/decryption operations, thereby maintaining high security while preserving encryption performance.
3Reliability
If secret sharing scheme is implemented over multipath networks, then information-theoretic security is achieved, but network complexity increases
Solution Approach 1:
The patent designs the secret sharing scheme to work universally over existing multipath network infrastructures without requiring specialized hardware or complex network configurations. The scheme leverages existing network paths and nodes, making it adaptable to various network topologies while maintaining information-theoretic security.
4Reliability
If trusted certification authority is used for key authentication, then key authenticity is ensured, but single point of failure and attack target are created
Solution Approach 1:
The patent segments the authentication mechanism by distributing secret shares across multiple untrusted nodes rather than concentrating the complete key in a single trusted authority. This segmentation eliminates the single point of failure and removes the attractive attack target that a centralized key repository would represent.
Solution Approach 2:
The patent enables the communicating parties to authenticate each other directly using their respective shares without requiring an external trusted authority. The system becomes self-sufficient for authentication purposes, eliminating the need for and vulnerability associated with external certification authorities.
Data Source
AI summary
A method for establishing a fully private, information theoretically secure interconnection between a source and a destination, over an unmanaged data network with at least a portion of a public infrastructure. Accordingly, n shares of the source data are created at the source according to a predetermined secret sharing scheme and the shares are sent to the data network, while encrypting the sent data using (n,k) secret sharing. A plurality of intermediating nodes are deployed in different locations over the network, to create a plurality of fully and/or partially independent paths in different directions on the path from the source to the destination, and with sufficient data separation. Then, the shares are sent over the plurality of fully and/or partially independent paths while forcing shares' carrying packets to pass through selected intermediate nodes, such that no router at any intermediating nodes intercepts k or more shares.