Shared Memory Re-Encryption for Secure Cross-Node Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure data sharing in shared memory lack flexibility and reliability, often requiring high trust in destination nodes and are prone to data leakage, with homomorphic encryption being limited by slow performance and inflexible access controls.
Innovation Solution
A method involving encryption of data with local and additional keys, allowing secure sharing and access control between nodes using a transcoder that manages encryption keys, ensuring the destination node cannot access plaintext data and can be terminated from sharing policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access controls are used to limit data sharing, then data security is improved, but reliability deteriorates because controls may be misconfigured or privileges escalated leading to data leakage
Solution Approach 1:
The patent introduces an intermediary encryption key mechanism where data is encrypted with a first key at the source node, then re-encrypted with a second key during transfer, and finally decrypted using both keys at the destination node. This intermediary encryption layer prevents direct access to plaintext data even if access controls are compromised, resolving the contradiction between security and control complexity.
2Reliability
If homomorphic encryption is used to provide secure access, then data security is improved, but productivity deteriorates due to slow performance
Solution Approach 1:
The patent changes the encryption parameter from homomorphic encryption to a hybrid symmetric encryption scheme using first and second keys. This parameter change maintains security by ensuring destination nodes cannot access plaintext without both keys, while dramatically improving processing speed by avoiding the computational overhead of homomorphic operations.
3Ease of operation
If source node decrypts data and shares decryption key with destination node, then ease of operation is improved, but reliability deteriorates because destination node gains access to plaintext data
Solution Approach 1:
The patent segments the decryption key into two separate keys (first key and second key) that must be combined to access plaintext data. The source node retains the first key and the destination node receives only the second key, making it impossible for the destination node to decrypt data independently. This segmentation maintains ease of operation while ensuring data protection.
4Reliability
If high degree of trust is required in destination node, then reliability is improved, but adaptability deteriorates because function replacement becomes difficult
Solution Approach 1:
The patent uses intermediary encryption as a trust mediator that eliminates the need for high trust in destination nodes. The encryption scheme with first and second keys allows the source node to control data access without requiring trust, enabling flexible function replacement and node substitution while maintaining security. This resolves the contradiction between reliability through trust and adaptability through flexibility.
Data Source
AI summary
A computer-implemented method includes, receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node. The data is encrypted in a local key of the source node. The method includes decrypting, by the source node, the locally encrypted data using the local key and encrypting, by the source node, the decrypted data using a first key for generating first encrypted data. The method also includes encrypting, by the source node, the first encrypted data using a second key for generating second encrypted data, and sending, by the source node, the second encrypted data to the destination node. A computer program product includes one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media. The program instructions includes program instructions to perform the foregoing method.