Stream-Based Key Management Reducing ABE Ciphertext Expansion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ciphertext expansion in attribute-based encryption (ABE) systems is significant, scaling linearly with policy size and security level, leading to high network bandwidth and processing costs, which can be prohibitive in environments with limited resources.
Innovation Solution
Implementing stream-based key management, where payloads are encrypted using a symmetric key and the key is encrypted once, allowing reuse across subscribers with the same policy, and new keys are generated when policies or subscribers change, thereby reducing the need to republish the key ciphertext.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attribute-based encryption is used to encrypt each payload with a secret key and transmit the encrypted key with the payload, then security is maintained, but ciphertext expansion increases linearly with policy size and super-linearly with security level
Solution Approach 1:
The encryption system is segmented into two distinct components: (1) a symmetric encryption layer that encrypts the payload using a secret key, and (2) an attribute-based encryption layer that encrypts only the secret key using ABE policy. This segmentation allows the payload to be encrypted efficiently while the key management handles the policy-based access control, thereby reducing overall ciphertext expansion while maintaining security.
Solution Approach 2:
The secret key is extracted from the payload encryption process and handled separately through ABE policy encryption. Instead of embedding the key management overhead within each payload encryption, the system extracts the key as a separate entity that can be reused across multiple payloads, reducing redundant ciphertext expansion for each transmission.
2Reliability
If a new symmetric key is generated for each payload encryption, then security is strengthened, but processing overhead and network bandwidth consumption increase
Solution Approach 1:
The symmetric key is generated in advance and reused across multiple payloads that share the same ABE policy, rather than generating a new key for each payload. This preliminary key generation approach reduces processing overhead and network bandwidth consumption while maintaining security through the ABE policy layer that controls key access.
Solution Approach 2:
A single symmetric key serves multiple functions by being reused across multiple payloads that are encrypted with the same ABE policy. This universal key approach eliminates the need for separate key generation and transmission for each payload, significantly reducing processing overhead and network bandwidth consumption while the ABE policy ensures that only authorized subscribers can decrypt the key.
3Ease of operation
If the encrypted symmetric key is transmitted with every payload, then decryption capability is ensured, but network bandwidth utilization increases significantly
Solution Approach 1:
The system applies different quality levels to different parts of the encryption process: the payload ciphertext is transmitted with high quality (fully encrypted), while the symmetric key is transmitted only once with ABE policy encryption to a broader audience. This local quality approach ensures that subscribers receive the key information they need without unnecessarily transmitting the same key information repeatedly with every payload, reducing network bandwidth consumption.
4Quantity of substance
If ciphertext expansion is reduced by reusing encryption keys, then network bandwidth is saved, but key management complexity increases
Solution Approach 1:
The ABE policy structure serves as an intermediary that manages the complexity of key reuse. Instead of implementing a complex custom key management system, the patent uses ABE policy as an intermediary layer that automatically handles key generation, encryption, and distribution based on subscriber attributes. This intermediary approach reduces ciphertext expansion while managing key complexity through the standardized ABE framework.
Data Source
AI summary
Techniques for stream-based key management are disclosed. A system obtains a first payload to be published to a first set of one or more subscribers, encrypts the first payload using a symmetric key, to obtain a first payload ciphertext, encrypts the symmetric key using an attribute-based encryption (ABE) policy associated with the first payload, to obtain a key ciphertext, and publishes the first payload ciphertext and the key ciphertext. The system obtains a second payload to be published to a second set of one or more subscribers. Responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the ABE policy is associated with the second payload, the system encrypts the second payload using the symmetric key, to obtain a second payload ciphertext, and publishes the second payload ciphertext without republishing the key ciphertext.