Alpha-Secure Key Distribution for Resource-Constrained Network Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security methods for Personal Area Networks (PANs) are resource-intensive and do not allow nodes to authenticate each other without a master node, nor provide secure access to external users, due to pre-distribution of cryptographic material and computational limitations in resource-constrained devices.
Innovation Solution
A method using an alpha-secure key distribution system where nodes compute a shared key from node-specific information derived from a multivariate polynomial root keying material, allowing external users to access the network without a master node, with reduced complexity access keying material shares and precomputation to minimize communication and computational requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public-key cryptography methods are used for granting access to external users, then security and trust are improved, but computational complexity, communication overhead, and memory requirements increase beyond resource-constrained device capabilities
Solution Approach 1:
The patent changes the cryptographic parameters by using symmetric key cryptography instead of public-key cryptography. This involves using pre-shared keys and key derivation functions that are computationally lighter, while maintaining security through proper key management and derivation mechanisms suitable for resource-constrained devices
Solution Approach 2:
The patent extracts the heavy computational burden of key generation and management from resource-constrained nodes by using a trusted setup phase where a stronger authority generates and distributes initial keying material. This allows nodes to operate with simpler cryptographic operations while maintaining security
2Productivity
If pre-distributed cryptographic material is used for node authentication, then authentication speed is improved, but the ability to provide access to external users is lost
Solution Approach 1:
The patent introduces dynamic key derivation where keys are not statically pre-distributed but dynamically generated through key derivation functions that take node identifiers and shared secrets as inputs. This allows the system to maintain fast authentication while adapting to different access scenarios including external user access
Solution Approach 2:
The patent segments the keying material into multiple components including pre-shared secrets, node-specific identifiers, and derived keys. This segmentation allows the system to maintain efficient pre-distributed authentication while enabling flexible access control for external users through controlled key derivation
3Reliability
If long keys are transmitted for public-key authentication, then security is improved, but communication overhead and memory requirements exceed available device capacities
Solution Approach 1:
The patent uses short-lived session keys derived from longer-term secrets for actual communication. The long-term pre-shared keys remain secure and stored, while temporary shorter keys are used for authentication and communication, reducing transmission overhead while maintaining security
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The present invention relates to a method for operating a network comprising communicating devices representing nodes of the network. More precisely, the invention relates to a method for operating a network (1), comprising a node (D1) and a system management device (3), the system management device comprising a root keying material being a set of alpha-secure functions having a degree of complexity of,and the node being provided with a node keying material share of degree of complexity a derived from the root keying material. The method comprises the following steps, upon receipt at the system management device of a request for an external user (4) to gain access to the node (D1): the system management device generates an external user keying material share of degree of complexity a from the root keying material and an access identifier, the system management device generates an access keying material of degree of complexity less than a, from the external user keying material share and an identifier of the node, the system management device provides the external user with the access keying material share and the access identifier, the external user derives a key from the access keying material share, and transmitting this key and the access certificate to the node, the node computes a key from the access identifier and the node keying material share, and the node compares the key transmitted by the external user and the key computed by the node, so as to authenticate the external user.