Backward Security Session Protocol for Paired Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication protocols, such as Bluetooth, face challenges in providing backward security, especially for low-power or low-capability devices, as generating unique ephemeral session keys for each communication session requires significant power and hardware resources, increasing costs and affecting battery life.
Innovation Solution
A method that modifies and synchronizes link keys between paired devices to generate new keys for each communication session, using a cloud service to share and ratchet link keys, ensuring backward security without the need for frequent pairing and reducing power consumption by using a hybrid approach combining ephemeral key generation and link key ratcheting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unique ephemeral session keys are generated for each communication session, then backward security is improved, but power consumption and hardware requirements increase
Solution Approach 1:
The patent segments the key management process into two parts: a long-term shared link key stored securely in both devices, and short-term session-specific encryption keys derived from this link key through key derivation functions. This segmentation allows devices to avoid generating full ephemeral key pairs while still achieving session-specific security, thereby reducing power consumption and hardware requirements while maintaining backward security.
Solution Approach 2:
The patent performs preliminary key establishment through a pairing process where a shared link key is generated and stored in both devices before actual communication sessions begin. This preliminary action eliminates the need to generate new cryptographic key pairs for each session, reducing the computational and power overhead during subsequent communications while ensuring that compromise of one session's derived key does not affect previous or future sessions.
2Reliability
If unique ephemeral session keys are generated for each communication session, then backward security is improved, but device complexity and costs increase
Solution Approach 1:
The patent divides the cryptographic functionality into a permanent shared link key stored in secure memory and temporary session keys generated through software-based key derivation. This segmentation eliminates the need for complex hardware random number generators and ephemeral key pair generation capabilities in low-cost devices, while still providing backward security through session-specific encryption keys.
Solution Approach 2:
The shared link key acts as an intermediary that enables secure communication without requiring direct exchange of complex ephemeral key pairs. Both devices store this intermediate key and use it to derive session-specific encryption keys, simplifying the hardware requirements while maintaining security properties equivalent to full ephemeral key exchange.
3Stability of the object's composition
If link keys are synchronized through cloud service, then key consistency between devices is improved, but dependency on network connectivity increases
Solution Approach 1:
The patent performs preliminary synchronization of the shared link key through cloud service when devices are connected to the network. Once synchronized, the key is stored locally in both devices, enabling offline communication without requiring continuous network connectivity. This preliminary action ensures key consistency while providing adaptability to network availability conditions.
Solution Approach 2:
Each device maintains its own copy of the shared link key in local secure storage, enabling it to independently derive session encryption keys without requiring real-time communication with the cloud service or the other device. This self-service capability ensures that once the key is initially synchronized, devices can operate independently and maintain key consistency without ongoing network dependency.
Data Source
AI summary
Some embodiments provide a method for establishing a secured session with backward security between a first device and a second device. In some embodiments, the method establishes a communication session between the first and second devices using shared keys stored at the first and second devices. The method exchanges encrypted data between the first and second devices as a part of the communication session. The method, upon completion of the communication session, modifies the shared key at the first device in a predictable way. The shared key is modified at the second device in the same predictable way. The method then stores the modified shared key at the first device. The modified shared key cannot be used to decrypt any portion of the encrypted data of the current and previous communication sessions.