Channel Binding Mechanism for Secure Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing EAP methods face challenges in securely binding access network parameters to keys without carrying these parameters in authentication methods, particularly in scenarios involving multiple authenticators and ports, leading to potential security vulnerabilities and inefficient key management.
Innovation Solution
A channel binding method based on parameter binding in a key derivation procedure, where a channel binding master key is used to derive channel binding keys, cryptographically binding access network parameters to keys, and using these keys for authenticator-supplicant protocols, allowing for hierarchical channel binding and secure key management across multiple authenticators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access network parameters are carried in authentication methods, then channel binding can be achieved, but authentication protocol complexity increases and EAP invariants are violated
Solution Approach 1:
The patent extracts the channel binding parameters from the authentication method and binds them directly to the key material through cryptographic operations. The access network parameters are incorporated into the key derivation process rather than being transmitted as separate authentication data, thus achieving channel binding without increasing protocol complexity
Solution Approach 2:
The patent introduces a key binding blob as an intermediary structure that contains the access network parameters. This blob serves as a mediator between the authentication protocol and the channel binding mechanism, allowing parameters to be bound to keys without requiring changes to the existing EAP authentication flow
2Ease of operation
If channel binding keys are derived without parameter binding, then key management is simpler, but security vulnerabilities arise from key misuse across multiple authenticators
Solution Approach 1:
The patent segments the key management system by deriving separate channel binding keys for each authenticator-port combination. The key binding blob is divided into components that uniquely identify each authenticator and port, ensuring that keys are scoped to specific channels without requiring complex centralized key management
Solution Approach 2:
The patent applies local quality by making each derived key unique to its specific authenticator and port context. The key derivation function incorporates local identifiers (authenticator ID, port ID) into the key binding blob, ensuring that each key has the specific property of being valid only for its designated channel
3Reliability
If parameters are bound to keys for each authenticator, then security is improved, but key derivation complexity increases
Solution Approach 1:
The patent creates a universal key binding blob structure that can accommodate multiple authenticators and ports through a standardized format. The same key derivation function and blob structure work for all authenticators, providing multi-functionality without increasing per-authenticator complexity
Solution Approach 2:
The patent uses parameter changes by varying the authenticator ID and port ID parameters within the key binding blob to derive different keys from the same base material. The key derivation function takes these parameter variations and produces distinct keys through cryptographic operations, maintaining security without requiring separate derivation processes
Data Source
AI summary
This document describes a channel binding mechanism based on parameter binding in the key derivation procedure. The method cryptographically binds access network parameters to a key without need to carry those parameters in EAP methods.