System and method to merge encrypted signals in distributed communication system

• US 9,461,974 B2
• Filed: 02/28/2014
• Issued: 10/04/2016
• Est. Priority Date: 02/28/2014
• Status: Active Grant

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Inventors: Rohloff, Kurt Ryan
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/194,597
• Publication Number:
  US 20150249650A1
• Time in Patent Office: 949 Days
• US Class Current: 1/1
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/3093 involving Lattices or polynomial equations, e.g. NTRU scheme

Abstract

In a computer implemented method for data privacy in a distributed communication system, the method includes: storing a plurality of secret keys, each secret key for a respective one of a plurality of client terminals; identifying a mixer key; generating a plurality of key switch hints for the client terminals, each of the key switch hints generated for a respective client terminal of the client terminals, using the mixer key and a respective secret key for each respective client terminal; sending the key switch hints to a mixer; switching a first encrypted data stream received from a first client terminal of the client terminals to an encrypted output data stream using the key switch hints; and sending the encrypted output data stream to a receiving client terminal of the client terminals to be decrypted by the receiving client terminal.

Claims

1. A computer implemented method for data privacy in a distributed communication system, the method comprising:

storing a plurality of secret keys, each secret key for a respective one of a plurality of client terminals;

identifying a mixer key;

generating a plurality of key switch hints for the client terminals, each of the key switch hints generated for a respective client terminal of the client terminals, using the mixer key and a respective secret key for each respective client terminal;

sending the key switch hints to a mixer;

switching a first encrypted data stream received from a first client terminal of the client terminals to an encrypted output data stream using the key switch hints; and

sending the encrypted output data stream to a receiving client terminal of the client terminals to be decrypted by the receiving client terminal.

2. The method of claim 1, wherein the key switch hints further comprise:

a plurality of client-to-mixer hints; and

a plurality of mixer-to-client hints, wherein each of the client-to-mixer hints and each of the mixer-to-client hints is associated with one of the client terminals.

3. The method of claim 1, further comprising:

switching the first encrypted data stream received from the first client terminal to a first encrypted data representation using a first key switch hint of the key switch hints;

switching a second encrypted data stream received from a second client terminal to a second encrypted data representation using a second key switch hint of the key switch hints; and

generating a third encrypted data representation based on the first encrypted data representation and the second encrypted data representation.

4. The method of claim 3, further comprising:

generating the output encrypted data stream based on the third encrypted data representation using a third key switch hint of the key switch hints.

5. The method of claim 1, wherein the receiving client terminal is one of the plurality of client terminals.

6. The method of claim 1, further comprising:

switching the first encrypted data stream received from the first client terminal to a first encrypted data representation using a first key switch hint of the plurality of key switch hints;

switching a second encrypted data stream received from a second client terminal to a second encrypted data representation using a second key switch hint of the plurality of key switch hints; and

combining the first encrypted data stream and the second encrypted data stream to generate a composite data stream.

7. The method of claim 6, further comprising switching the composite data stream to the encrypted output data stream using a key switch hint of the plurality of key switch hints corresponding to the receiving client terminal.

8. A computer implemented method for data privacy in a distributed communication system, the method comprising:

receiving a plurality of key switch hints, each of the plurality of key switch hints corresponding to a respective one of a plurality of client terminals;

receiving a first encrypted data stream from a first client terminal of the client terminals;

switching the first encrypted data stream using a first key switch hint of the plurality of key switch hints to generate a first encrypted data representation of the first encrypted data stream; and

generating an encrypted output data stream based on the first encrypted data representation.

9. The method of claim 8, further comprising:

receiving a second encrypted data stream from a second client terminal of the client terminals;

switching the second encrypted data stream using a second key switch hint of the plurality of key switch hints to generate a second encrypted data representation of the second encrypted data stream; and

generating the encrypted output data stream based on the first encrypted data representation and the second encrypted data representation.

10. The method of claim 9, wherein generating the encrypted output data stream further comprises:

generating a third encrypted data representation based on the first encrypted data representation and the second encrypted data representation; and

generating the output encrypted data stream based on the third encrypted data representation and a third key switch hint of the key switch hints.

11. The method of claim 9, wherein generating the encrypted output data stream further comprises combining the first encrypted data stream with the second encrypted data stream to generate a composite data stream.

12. The method of claim 11, wherein generating the encrypted output data stream further comprises switching the composite data stream to the output encrypted data stream using a key switch hint of the plurality of key switch hints corresponding to a recipient client terminal of the client terminals.

13. The method of claim 8, further comprising receiving the plurality of key switch hints from a trusted third party, wherein the key switch hints are generated based on a respective client private key of each of the client terminals and a mixer private key of the trusted third party.

14. A distributed communication system comprising a plurality of client terminals communicating through a communication hub, the communication hub comprising:

an input port for receiving a plurality of key switch hints and a plurality of encrypted data streams, wherein each of the key switch hints and each of the encrypted data streams correspond to a respective one of the client terminals;

a first switching circuit coupled to the input port for generating an encrypted data representation of each of the encrypted data streams using a corresponding one of the key switch hints; and

an output terminal coupled to the switching circuit for generating output encrypted data streams based on the encrypted data representation of each of the encrypted data streams.

15. The distributed communication system of claim 14, wherein the communication hub further comprises one or more adders for combining the encrypted data representation of each of the encrypted data streams to generate a composite data set.

16. The distributed communication system of claim 15, wherein the communication hub further comprises a second switching circuit coupled to the one or more adders for generating the output data stream using the composite data set and one of the key switch hints.

17. The distributed communication system of claim 14, wherein the plurality of key switch hints further comprises:

a plurality of client-to-mixer hints each corresponding to the respective one of the client terminals; and

a plurality of mixer-to-client hints each corresponding to the respective one of the client terminals.

18. The distributed communication system of claim 14, further comprising a trusted third party, wherein the trusted third party comprises:

a plurality of input terminals for receiving a respective client secret key from each of the client terminals;

a key generator for generating a mixer private key, wherein the trusted third party is configured to generate the key switch hints based on the respective client secret key from each of the client terminals and the mixer private key; and

an output terminal for providing the key switch hints to the communication hub.

19. The distributed communication system of claim 18, wherein the each of the client terminals comprises a decryption circuit for decrypting the output encrypted data stream using the respective client secret key.

20. The distributed communication system of claim 18, wherein the each of the client terminals comprises an encryption circuit for encrypting digital data using the respective client secret key.