Hierarchical Vehicular Data Access for Selective Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for controlling access to encrypted vehicular data face challenges such as unintended data leakage, over-privileged access, and increased complexity in managing cryptographic keys, particularly when third-party service providers need to access specific data without compromising user privacy.
Innovation Solution
A hierarchical access control method using Hierarchical Identity Based Encryption (HIBE) that allows authorized users to decrypt select encrypted data and associated child data by generating child keys from a root key, stored in a cloud server, enabling secure and controlled access without sharing the entire cryptographic key set.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the service provider is provided with the cryptographic key to decrypt stored data, then the service provider can access the diagnostic data required for repairs, but the service provider can also decrypt and download all stored data including private user information
Solution Approach 1:
The patent segments the cryptographic key into multiple parts using secret sharing schemes. The full cryptographic key is divided into shares distributed among the vehicle owner, service provider, and trusted third party. No single entity possesses the complete key, preventing unauthorized access to all data while enabling collaborative decryption of specific diagnostic data when needed.
Solution Approach 2:
The patent introduces a trusted third party as an intermediary that holds a share of the cryptographic key. This intermediary enables the service provider to access diagnostic data by combining their key share with the owner's share through secure multi-party computation, without the service provider ever obtaining the full key or accessing unrelated private data.
2Object-affected harmful factors
If data is individually encrypted according to type and collection time, then data security is improved, but the complexity of managing multiple cryptographic keys increases
Solution Approach 1:
The patent segments both the data and the key management system. Data is organized into categories (diagnostic data, private information) with different encryption requirements. The cryptographic key is segmented into shares, and access policies are segmented by data type and time period, simplifying the management of encryption credentials while maintaining security.
Solution Approach 2:
The patent implements partial decryption capabilities where the service provider can decrypt only the specific diagnostic data shares needed for repairs, rather than managing keys for all possible data types. This reduces key management complexity by limiting key usage to necessary portions of the encrypted data set.
3Loss of information
If the vehicle owner provides multiple cryptographic keys for different time periods, then the service provider can access historical diagnostic data, but the key management process becomes increasingly complex
Solution Approach 1:
The patent segments time-based access control into discrete key shares valid for specific time periods. Each key share is associated with a particular time range, and the service provider can request decryption for historical data by presenting the appropriate time-bound key share, eliminating the need to manage all keys for all time periods simultaneously.
Solution Approach 2:
The patent performs preliminary key generation and distribution, creating time-bound key shares in advance for different service periods. This allows the service provider to access historical diagnostic data without requiring real-time key management complexity, as the appropriate key shares are pre-configured for specific time ranges.
Data Source
AI summary
A system for controlling access to encrypted vehicular data employs a hierarchical access control method that allows select encrypted vehicular data stored in a cloud server to be accessed by an authorized user in a hierarchical manner whereby the authorized user is then able to decrypt the select encrypted data and all child data associated with the select encrypted data.