Authenticated ECDHE Key Exchange via Key Server

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing ECDHE key exchanges lack authentication, making them susceptible to 'man in the middle' attacks and not providing forward secrecy, which increases security risks over time.

Innovation Solution

A system and method for conducting an authenticated ephemeral elliptic curve Diffie-Hellman key exchange (ECDHE) using a device, a server, and a key server, where the device and server record compatible cryptographic parameters, and the key server holds the network static private key, enabling authentication and forward secrecy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If ECDHE key exchange is used without authentication, then key exchange speed and efficiency are improved, but security against man in the middle attacks deteriorates

Engineering Contradiction:

Improvekey exchange speedVSAvoidsecurity against man in the middle attacks

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent introduces a key server as an intermediary authority that provides authenticated ECDHE key exchanges. The key server issues pre-computed ECDHE parameters to devices, enabling efficient key exchange while maintaining security through centralized authentication. This mediator approach resolves the contradiction by providing both speed (pre-computed keys) and security (authenticated issuance).

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary key exchange setup by pre-computing and distributing ECDHE parameters through the key server before actual communication. This preliminary action enables fast key exchange during actual data transmission while maintaining security through authenticated parameter distribution, resolving the speed-security contradiction.

Inventive Principle:

Principle #10Preliminary action

2Device complexity

If ECDHE key exchange is used without forward secrecy, then implementation complexity is reduced, but long-term security deteriorates

Engineering Contradiction:

Improveimplementation complexityVSAvoidforward secrecy

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent implements dynamic key management where devices rotate ECDHE parameters through the key server. The system dynamically issues new pre-computed key pairs to devices, enabling forward secrecy without requiring complex local key management. The key server handles the dynamic key rotation, simplifying implementation while providing long-term security.

Inventive Principle:

Principle #15Dynamics

3Reliability

If full certificate verification is required, then authentication reliability is improved, but key management complexity and processing time deteriorate

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex certificate verification process from the device and relocates it to the centralized key server. The key server performs authentication and issues pre-computed ECDHE parameters, eliminating the need for devices to perform complex certificate chains. This extraction maintains authentication reliability while significantly reducing device complexity and processing requirements.

Inventive Principle:

Principle #2Taking out (Extraction)

4Device complexity

If static PKI keys are used without proper protection, then key management simplicity is improved, but vulnerability to attacks deteriorates

Engineering Contradiction:

Improvekey management simplicityVSAvoidvulnerability to attacks on static PKI keys

Core Design Contradiction:

Device complexityVSObject-affected harmful factors

Solution Approach 1:

The key server acts as a protected intermediary that securely stores and manages static PKI keys. The server issues authenticated ECDHE parameters to devices, protecting static keys from direct exposure to devices while maintaining key management simplicity. This mediator approach isolates the vulnerability surface while preserving operational simplicity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250202684A1ECDHE Key Exchange for Server Authentication and a Key Server

Publication Date: 2025.06.19 NETWORK 1 TECH

AI summary

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.