Certificateless Cryptosystem Key Generation for IoT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional public key infrastructure (PKI) for certificate-based cryptosystems is costly to establish and maintain, and incurs substantial computational overhead, which is not ideal for Internet-of-Things (IoT) devices with limited resources, and existing certificate-free systems face efficiency and key escrow problems.
Innovation Solution
A certificate-free, identity-based cryptosystem using an exponent product of powers property for implicit certification, which reduces scalar multiplication to simple point addition, and a certificateless cryptosystem with a single key generation center, providing efficient key exchange, encryption, and signature schemes without additional overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional certificate-based PKI is used to ensure authenticity, then security against man-in-the-middle attacks is improved, but computational overhead and infrastructure cost increase significantly
Solution Approach 1:
The patent extracts the certification function from the traditional PKI infrastructure and embeds it directly into the cryptographic key generation process. The Key Generation Center (KGC) generates user private keys by combining a system-wide master secret with user-specific information, eliminating the need for separate certificate issuance and management infrastructure while maintaining authenticity verification.
Solution Approach 2:
The KGC serves multiple functions simultaneously: it acts as the trusted authority for key generation, the certification body for authenticity verification, and the root of trust for the entire system. This multi-functionality consolidates the fragmented PKI infrastructure into a single entity, reducing overall system complexity while preserving security guarantees.
2Reliability
If certificates are issued and managed by certificate authorities, then user identity verification is improved, but computational overhead for issuing, maintaining, and verifying certificates increases
Solution Approach 1:
The system performs identity verification preliminarily during the key generation phase. The KGC verifies user identity and embeds certification information directly into the generated private key, so that subsequent communications automatically carry verification without requiring separate certificate validation computations.
Solution Approach 2:
The patent merges the key generation process with the certification process. Instead of separately generating keys and issuing certificates, the KGC performs both operations simultaneously by generating private keys that inherently contain certification information, eliminating redundant computational steps for certificate issuance and maintenance.
3Reliability
If certificate chains are verified to ensure authenticity, then security is improved, but computational overhead and communication overhead increase
Solution Approach 1:
The patent extracts the certification information from separate certificate structures and embeds it directly within the user's private key during generation. This eliminates the need for separate certificate chain verification, as the authenticity information is inherently present in the key material itself, reducing verification time to minimal computational checks.
4Productivity
If identity-based cryptosystems are used to reduce overhead, then computational efficiency is improved, but key escrow problems arise
Solution Approach 1:
The user private key is segmented into two components: a system-wide master secret component generated by the KGC and a user-specific component derived from user-controlled information. This segmentation allows the KGC to generate keys efficiently while ensuring that the user-specific component remains under user control, mitigating key escrow risks while maintaining computational efficiency.
Data Source
AI summary
Disclosed are various embodiments for certificate-free cryptosystems that achieve significant computational and communication efficiency as compared to prior systems. A private key generator (PKG) generates a master public key and a master private key unique to the PKG; receives identifying information for at least one client device; generates a public key for the at least one client device; generates a private key for the at least one client device by: performing a hash of the identifying information using the public key generated for the at least one client device to generate a plurality of indices; identifying values corresponding to the indices from the master private key; and deriving the private key based at least in part on a summation of the values corresponding to the indices; and sends the public key and the private key to the at least one client device.