18 April 2006 Extending key sharing: how to generate a key tightly coupled to a network security policy
Author Affiliations +
Current state of the art security policy technologies, besides the small scale limitation and largely manual nature of accompanied management methods, are lacking a) in real-timeliness of policy implementation and b) vulnerabilities and inflexibility stemming from the centralized policy decision making; even if, for example, a policy description or access control database is distributed, the actual decision is often a centralized action and forms a system single point of failure. In this paper we are presenting a new fundamental concept that allows implement a security policy by a systematic and efficient key distribution procedure. Specifically, we extend the polynomial Shamir key splitting. According to this, a global key is split into n parts, any k of which can re-construct the original key. In this paper we present a method that instead of having "any k parts" be able to re-construct the original key, the latter can only be reconstructed if keys are combined as any access control policy describes. This leads into an easily deployable key generation procedure that results a single key per entity that "knows" its role in the specific access control policy from which it was derived. The system is considered efficient as it may be used to avoid expensive PKI operations or pairwise key distributions as well as provides superior security due to its distributed nature, the fact that the key is tightly coupled to the policy, and that policy change may be implemented easier and faster.
© (2006) COPYRIGHT Society of Photo-Optical Instrumentation Engineers (SPIE). Downloading of the abstract is permitted for personal use only.
Matheos Kazantzidis, Matheos Kazantzidis, } "Extending key sharing: how to generate a key tightly coupled to a network security policy", Proc. SPIE 6241, Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security 2006, 62410S (18 April 2006); doi: 10.1117/12.664747; https://doi.org/10.1117/12.664747


Micromanaging the IoT space
Proceedings of SPIE (May 01 2017)
Application of IPsec to teleradiology
Proceedings of SPIE (July 17 1999)
A universal trust framework for pervasive computing
Proceedings of SPIE (March 28 2004)
End-to-end communications security
Proceedings of SPIE (April 17 2006)

Back to Top