# Secure and Privacy-Respecting Documentation for Interactive Manufacturing and Quality Assurance
## 4 Privacy-Preserving System Design
### Video Encryption  
Whenever a worker executes a critical work step in the manufacturing process, a new video should be recorded for documentation purposes. This video needs to be encrypted in a way that it is accessible only for the recorded worker in cooperation with at least one of the trusted representatives. In order to achieve this requirement, we developed a multi-level encryption scheme that includes a suitable secret-sharing mechanism for the encryption keys (c.f. Figure 4).  
Figure 3: 4 Crypt system design.  
Secret-sharing schemes as described in [23] are well-researched methods to distribute a specific secret to a set of participants without disclosing the secret to any one party. Participants only receive a so-called _share_ of the secret, which in itself does not contain any information. Only when a certain number of participants disclose their respective share, the underlying secret can be recovered.  
The 4 Crypt system implements an encryption scheme that uses a secret-sharing algorithm to distribute encryption keys to a number of trusted individuals. The details of this key-sharing mechanism are shown in Figure 4, with key usages displayed as arrows. 4 Crypt automatically encrypts recorded videos with a randomly drawn, symmetric video file key (VFK). In Figure 4, this is displayed in the bottom two levels for an exemplary video file. The video file keys are not known to either the recorded worker, the trusted representatives, or the employer. Instead, they remain stored on the documentation system and are themselves encrypted with one or more group access keys (GAK). A video-specific group access key is created by randomly drawing one symmetric key share \(k_{i}\) for each group member (either a worker or a trusted representative) and then performing a bitwise XOR-operation on the shares. In Figure 4, this is shown in the top two levels, with the XOR-operation denoted by the symbol \(\oplus\). As a result, the group access keys can only be recovered by collecting the key shares of all participants in the respective group. Finally, the key shares are asymmetrically encrypted using the public keys of the respective group members and stored on the documentation system. This encryption scheme allows 4 Crypt to securely store videos in a way that they can only be recovered if all members of at least one group consent by disclosing their video-specific key shares.  
The resulting video acquisition and encryption process based on this key sharing architecture is shown in Figure 5. At first, the worker \(w\) authenticates and logs in by holding his personal smartphone on the NFC-reader near the assembly station. Once the critical work step is about to be performed, 4 Crypt initiates the recording process. The video documentation system then creates a new symmetric encryption key \(v\)\(f\)k for the video file. Furthermore, a new group access key \(g\)\(g\)\(k\) has to be created for each configured group consisting of the authenticated worker \(w\) and a set of \(n\) trusted representatives. For this, the documentation system generates a set of random key shares \(k_{j}\) for each member of the group and calculates the group access key \(g\)\(g\)\(k\) by XORing them together. The key share  
Figure 4: Encryption and key sharing architecture of 4 Crypt.  
\(k_{w}\) of the worker is sent back to the worker's smartphone over NFC to asymmetrically sign and encrypt it with the worker's private/public keys. The key shares of the other group members are encrypted with the respective public key retrieved from the external LDAP service. All encrypted/signed key shares are then stored in the local key store. Finally, the video file key is encrypted with each group access key and deposited in the key store as well. Once the recording has been initialized in that way, each video image captured by the cameras mounted at the assembly station is automatically encrypted with the video file key.