Search

In this paper, we propose a generalized scheme for the predistribution of keys. Calculations are performed in an arbitrary vector space. Key materials are formed based on vector space elements and symmetric operator over a vector space. Two particular cases of application of the proposed scheme are considered.

The symmetric encryption session key generation protocol based on the Shamir secret sharing scheme and the Blom key predistribution scheme is proposed. Predistribution of key materials through secure channels is used. Key calculation is based on symmetric polynomials from three variables. Key calculation is based on threshold scheme (3,4). The basic protocol for two participants was considered. A scheme for an arbitrary number of users has been summarized.

A modification is presented of the scheme of preliminary Blom’s key distribution taking into account the direction of information flows. The modification makes it necessary to use a function of three variables. The function of forming key materials ceases to be symmetrical. An exponential form of this function was proposed, which does not increase the amount of key materials.

The implementation of mandatory distribution of access in distributed systems taking into account a user hierarchy is considered. The access control is based on the scheme of preliminary key distribution similar to KDP-scheme. The algorithm of building a family of subsets taking into account a user hierarchy was developed.

In the article, the KDP key pre-distribution scheme is modified for attribute access control. A scheme for implementing attribute-based access control on symmetric encryption is proposed. There are three participants in the scheme: a key distribution server, a subject, and a storage server. The key distribution server sends key content over secure channels when the system is initialized. The key materials content is determined by the attributes of the object and the subject. The storage server calculates the object ′s encryption key based on the object ′s key materials and attributes. The object is stored encrypted. If the subject has the necessary attributes, it can calculate the encryption key and access to object. If the subject does not have a sufficient set of attributes, the key cannot be computed and access is denied.

A modification of the KDP scheme for the distribution of encryption keys is considered as applied to a distributed computer system with a discretionary security model. Limited access is specified as forbidden channels of data transmission. The scheme of preliminary key distribution is designed in such a way that it is impossible for forbidden channels to create a key-pair for the data exchange. An example of the construction of the proposed scheme is presented.

In article the modification of the Blom's keys preliminary distribution scheme, considering the direction of information streams is suggested. For this modification it is necessary to use function from three variables. Function of formation of key materials will be the asymmetrical. The exponential form of this function which does not increase the volume of key materials is suggested.

The possibility of use the keys preliminary distribution KDP-scheme for mandatory access control realization in the distributed systems with user's hierarchy is considered. The modified keys preliminary distribution algorithm is suggested. It is developed a method for creation of subsets family for solution this task.