Stream-based key management
Techniques for stream-based key management are disclosed. A system obtains a first payload to be published to a first set of one or more subscribers, encrypts the first payload using a symmetric key, to obtain a first payload ciphertext, encrypts the symmetric key using an attribute-based encryption (ABE) policy associated with the first payload, to obtain a key ciphertext, and publishes the first payload ciphertext and the key ciphertext. The system obtains a second payload to be published to a second set of one or more subscribers. Responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the ABE policy is associated with the second payload, the system encrypts the second payload using the symmetric key, to obtain a second payload ciphertext, and publishes the second payload ciphertext without republishing the key ciphertext.
1. One or more non-transitory machine-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
obtaining a first payload to be published to a first set of one or more subscribers;
encrypting the first payload using a first symmetric key, to obtain a first payload ciphertext;
encrypting the first symmetric key using a first attribute-based encryption (ABE) policy associated with the first payload, to obtain a first key ciphertext;
publishing the first payload ciphertext and the first key ciphertext to the first set of one or more subscribers;
obtaining a second payload to be published to a second set of one or more subscribers;
determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the second payload; and
responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the second payload,
(a) encrypting the second payload using the first symmetric key, to obtain a second payload ciphertext, and
(b) publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers.
2. The one or more non-transitory computer-readable media of claim 1 , the operations further comprising:
receiving one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext,
publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers, being further responsive to receiving the one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext.
3. The one or more non-transitory computer-readable media of claim 1 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that a second ABE policy associated with the third payload is different from the first ABE policy; and
responsive at least to determining that the second ABE policy associated with the third payload is different from the first ABE policy,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key using the second ABE policy, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
4. The one or more non-transitory computer-readable media of claim 1 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers; and
responsive at least to determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
5. The one or more non-transitory computer-readable media of claim 4 , the operations further comprising:
after publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers, obtaining a fourth payload to be published to a fourth set of one or more subscribers;
determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the fourth payload;
responsive at least to determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the fourth payload,
(a) encrypting the fourth payload using the first symmetric key, to obtain a fourth payload ciphertext, and
(b) publishing the fourth payload ciphertext to the fourth set of one or more subscribers, without republishing the first key ciphertext to the fourth set of one or more subscribers;
after publishing the fourth payload ciphertext to the fourth set of one or more subscribers, obtaining a fifth payload to be published to a fifth set of one or more subscribers;
determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers;
determining that a same ABE policy is associated with the fifth payload and the third payload;
responsive at least to determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers and a same ABE policy is associated with the fifth payload and the third payload,
(a) encrypting the fifth payload using the second symmetric key, to obtain a fifth payload ciphertext, and
(b) publishing the fifth payload ciphertext to the fifth set of one or more subscribers, without republishing the second key ciphertext to the fifth set of one or more subscribers.
6. The one or more non-transitory computer-readable media of claim 1 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that the first symmetric key is no longer valid, based at least on a key expiration policy; and
responsive at least to determining that the first symmetric key is no longer valid,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
7. The one or more non-transitory computer-readable media of claim 1 , the first set of one or more subscribers having at least one subscriber that is not in the second set of one or more subscribers.
8. A system comprising:
at least one device including a hardware processor;
the system being configured to perform operations comprising:
obtaining a first payload to be published to a first set of one or more subscribers;
encrypting the first payload using a first symmetric key, to obtain a first payload ciphertext;
encrypting the first symmetric key using a first attribute-based encryption (ABE) policy associated with the first payload, to obtain a first key ciphertext;
publishing the first payload ciphertext and the first key ciphertext to the first set of one or more subscribers;
obtaining a second payload to be published to a second set of one or more subscribers;
determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the second payload; and
responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the second payload,
(a) encrypting the second payload using the first symmetric key, to obtain a second payload ciphertext, and
(b) publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers.
9. The system of claim 8 , the operations further comprising:
receiving one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext,
publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers, being further responsive to receiving the one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext.
10. The system of claim 8 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that a second ABE policy associated with the third payload is different from the first ABE policy; and
responsive at least to determining that the second ABE policy associated with the third payload is different from the first ABE policy,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key using the second ABE policy, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
11. The system of claim 8 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers; and
responsive at least to determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
12. The system of claim 11 , the operations further comprising:
after publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers, obtaining a fourth payload to be published to a fourth set of one or more subscribers;
determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the fourth payload;
responsive at least to determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the fourth payload,
(a) encrypting the fourth payload using the first symmetric key, to obtain a fourth payload ciphertext, and
(b) publishing the fourth payload ciphertext to the fourth set of one or more subscribers, without republishing the first key ciphertext to the fourth set of one or more subscribers;
after publishing the fourth payload ciphertext to the fourth set of one or more subscribers, obtaining a fifth payload to be published to a fifth set of one or more subscribers;
determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers;
determining that a same ABE policy is associated with the fifth payload and the third payload;
responsive at least to determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers and a same ABE policy is associated with the fifth payload and the third payload,
(a) encrypting the fifth payload using the second symmetric key, to obtain a fifth payload ciphertext, and
(b) publishing the fifth payload ciphertext to the fifth set of one or more subscribers, without republishing the second key ciphertext to the fifth set of one or more subscribers.
13. The system of claim 8 , the operations further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that the first symmetric key is no longer valid, based at least on a key expiration policy; and
responsive at least to determining that the first symmetric key is no longer valid,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
14. The system of claim 8 , the first set of one or more subscribers having at least one subscriber that is not in the second set of one or more subscribers.
15. A method comprising:
obtaining a first payload to be published to a first set of one or more subscribers;
encrypting the first payload using a first symmetric key, to obtain a first payload ciphertext;
encrypting the first symmetric key using a first attribute-based encryption (ABE) policy associated with the first payload, to obtain a first key ciphertext;
publishing the first payload ciphertext and the first key ciphertext to the first set of one or more subscribers;
obtaining a second payload to be published to a second set of one or more subscribers;
determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the second payload; and
responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the second payload,
(a) encrypting the second payload using the first symmetric key, to obtain a second payload ciphertext, and
(b) publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers.
16. The method of claim 15 , further comprising:
receiving one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext,
publishing the second payload ciphertext to the second set of one or more subscribers, without republishing the first key ciphertext to the second set of one or more subscribers, being further responsive to receiving the one or more acknowledgements that each subscriber in the first set of one or more subscribers received the first key ciphertext.
17. The method of claim 15 , further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that a second ABE policy associated with the third payload is different from the first ABE policy; and
responsive at least to determining that the second ABE policy associated with the third payload is different from the first ABE policy,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key using the second ABE policy, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
18. The method of claim 15 , further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers; and
responsive at least to determining that at least one subscriber in the third set of one more subscribers is not in the first set of one or more subscribers,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.
19. The method of claim 18 , comprising:
after publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers, obtaining a fourth payload to be published to a fourth set of one or more subscribers;
determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers;
determining that the first ABE policy is associated with the fourth payload;
responsive at least to determining that each subscriber in the fourth set of one more subscribers is in the first set of one or more subscribers and the first ABE policy is associated with the fourth payload,
(a) encrypting the fourth payload using the first symmetric key, to obtain a fourth payload ciphertext, and
(b) publishing the fourth payload ciphertext to the fourth set of one or more subscribers, without republishing the first key ciphertext to the fourth set of one or more subscribers;
after publishing the fourth payload ciphertext to the fourth set of one or more subscribers, obtaining a fifth payload to be published to a fifth set of one or more subscribers;
determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers;
determining that a same ABE policy is associated with the fifth payload and the third payload;
responsive at least to determining that each subscriber in the fifth set of one more subscribers is in the third set of one or more subscribers and a same ABE policy is associated with the fifth payload and the third payload,
(a) encrypting the fifth payload using the second symmetric key, to obtain a fifth payload ciphertext, and
(b) publishing the fifth payload ciphertext to the fifth set of one or more subscribers, without republishing the second key ciphertext to the fifth set of one or more subscribers.
20. The method of claim 15 , further comprising:
obtaining a third payload to be published to a third set of one or more subscribers;
determining that the first symmetric key is no longer valid, based at least on a key expiration policy; and
responsive at least to determining that the first symmetric key is no longer valid,
(a) encrypting the third payload using a second symmetric key that is different from the first symmetric key, to obtain a third payload ciphertext,
(b) encrypting the second symmetric key, to obtain a second key ciphertext, and
(c) publishing the third payload ciphertext and the second key ciphertext to the third set of one or more subscribers.