System and method to merge encrypted signals in distributed communication system

• US 9,313,181 B2
• Filed: 02/28/2014
• Issued: 04/12/2016
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Inventors: Rohloff, Kurt Ryan
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/194,585
• Publication Number:
  US 20150249649A1
• Time in Patent Office: 774 Days
• Field of Search: 713/153
• US Class Current: 1/1
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/3093 involving Lattices or polynomial equations, e.g. NTRU scheme

Abstract

In a computer implemented method for data privacy in a distributed communication system including a plurality of client terminals, the method includes: receiving, from each of the plurality of client terminals, a group of key switch hints generated by said each of the client terminals, wherein each group of key switch hints include a key switch hint corresponding to each other one of the client terminals; receiving, from each of the client terminals, an encrypted data stream; switching each of the encrypted data streams using the key switch hints corresponding to said each other one of the client terminals to generate a respective switched data set for said each of the encrypted data streams, wherein each switched data set includes a plurality of encrypted data representations of said each of the encrypted data streams; and generating an encrypted output data stream for each of the client terminals using the switched data set for each encrypted data stream.

Claims

1. A computer implemented method for data privacy in a distributed communication system comprising a plurality of client terminals, the method comprising:

receiving, from each of the plurality of client terminals, a group of key switch hints generated by said each of the client terminals, wherein each group of key switch hints comprises a key switch hint corresponding to each other one of the client terminals;

receiving, from each of the client terminals, an encrypted data stream;

switching each of the encrypted data streams using the key switch hints corresponding to said each other one of the client terminals to generate a respective switched data set for said each of the encrypted data streams, wherein each switched data set comprises a plurality of encrypted data representations of said each of the encrypted data streams; and

generating an encrypted output data stream for each of the client terminals using the switched data set for each encrypted data stream.

2. The method of claim 1, further comprising:

receiving a public key corresponding to each of the plurality of client terminals; and

providing, to each of the client terminals, the public key corresponding to said each other one of the client terminals.

3. The method of claim 2, wherein for each group of key switch hints, the key switch hint corresponding to said each other one of the client terminals is generated based on the public key corresponding to said each other one of the client terminals and a private key generated by a client terminal corresponding to the said each group of key switch hints.

4. The method of claim 1, wherein generating the encrypted output data stream further comprises generating a composite switched data set based on the switched data set corresponding to each switched data set.

5. The method of claim 4, further comprising demultiplexing the composite switched data set to generate the encrypted output data stream corresponding to each of the client terminals.

6. The method of claim 5, wherein the composite switched data set comprises a matrix of the encrypted output data stream corresponding to each of the client terminals.

7. The method of claim 6, further comprising providing a row or a column of the matrix to a client terminal of the plurality of client terminals as the output encrypted data stream for the client terminal.

8. A computer implemented method for data privacy in a distributed communication system coupled to first, second, and third client terminals, the method comprising:

receiving, from the first client terminal, a first key switch hint corresponding to the second client terminal and a second key switch hint corresponding to the third client terminal;

receiving, from the second client terminal, a third key switch hint corresponding to the first client terminal and a fourth key switch hint corresponding to the third client terminal;

receiving, from the third client terminal, a fifth key switch hint corresponding to the first client terminal and a sixth key switch hint corresponding to the second client terminal;

receiving an encrypted data stream from the first, second, and third client terminals;

switching the encrypted data stream received from the first client terminal using the first key switch hint and the second key switch hint to generate a first encrypted data representation;

switching the encrypted data stream received from the second client terminal using the third key switch hint and the fourth key switch hint to generate a second encrypted data representation;

switching the encrypted data stream received from the third client terminal using the fifth key switch hint and the sixth key switch hint to generate a third encrypted data representation; and

generating first, second, and third encrypted output data streams each corresponding to the first, second, and third client terminals, respectively, using the first, second, and third encrypted data representations.

9. The method of claim 8, further comprising:

receiving a first public key corresponding to the first client terminal;

receiving a second public key corresponding to the second client terminal;

providing the first public key to the second client terminal; and

providing the second public key to the first client terminal.

10. The method of claim 9, wherein the first key switch hint is generated based on the second public key and a private key generated by the first client terminal.

11. The method of claim 8, further comprising:

generating a composite switched data set comprising the first encrypted data representation, the second encrypted data representation, and the third encrypted data representation; and

generating the first, second, and third encrypted output data streams based on the composite switched data set.

12. The method of claim 11, wherein the composite switched data set comprises a matrix, and wherein a first row or column of the matrix comprises the first encrypted output data stream.

13. The method of claim 11, further comprising demultiplexing the composite switched data set to generate the first, second, and third encrypted output data streams.

14. A central communication hub in a distributed communication system, the central communication hub comprising:

an input port for receiving a first group of key switch hints and a first encrypted data stream;

one or more switching circuits configured to switch the first encrypted data stream using the first group of key switch hints to generate a first switched data set;

a demultiplexer for generating an encrypted output data stream using the first switched data set; and

an output terminal for providing the encrypted output data stream to a client terminal.

15. The communication hub of claim 14, wherein the input port is configured to receive a second group of key switch hints and a second encrypted data stream, and wherein the one or more switching circuits are configured to switch the second encrypted data stream using the second group of key switch hints to generate a second switched data set.

16. The communication hub of claim 15, further comprising one or more adders for generating a composite data set based on the first switched data set and the second switched data set.

17. The communication hub of claim 15, wherein the distributed communication system comprises a plurality of client terminals, and wherein the first group of key switch hints are generated by a first client terminal of the plurality of client terminals and the first group of key switch hints corresponds to other ones of the plurality of client terminals.

18. The communication hub of claim 14, wherein the distributed communication system comprises a plurality of client terminals each comprising a key generator for generating a public key and a private key.

19. The communication hub of claim 18, wherein the plurality of client terminals further comprise an input port for receiving the public key corresponding to each other one of the client terminals.

20. The communication hub of claim 19, wherein the first group of key switch hints is generated based on the private key of the a first one of the plurality of client terminals and the public key of said each other one of the plurality of client terminals.