Communication Device Network Key Sharing Cost Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for sharing a network key as an encryption key among devices in a network, such as MIKEY, are costly when implemented in low-cost equipment.
Innovation Solution
A communication device with a network access authenticating unit, a communication unit, a key transport key generating unit, and a network key acquiring unit, which executes network access authentication, generates a key transport key, and decrypts an encrypted network key to securely share the network key for encryption and data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MIKEY is used for network key sharing, then secure key delivery is achieved, but implementation cost increases for low-cost equipment
Solution Approach 1:
The patent segments the key delivery process into two distinct phases: (1) authentication phase where the client proves identity to the server, and (2) key delivery phase where the server sends the network key only after successful authentication. This segmentation allows low-cost equipment to implement only the necessary authentication functions without requiring full MIKEY functionality, thereby reducing implementation cost while maintaining security.
Solution Approach 2:
The patent performs authentication as a preliminary action before key delivery. The client must successfully authenticate with the server before receiving the network key. This preliminary authentication ensures that only authorized devices can obtain the key, maintaining security while allowing simplified key management for low-cost equipment.
2Reliability
If traditional key sharing methods are used, then security is maintained, but device complexity increases
Solution Approach 1:
The patent extracts the authentication function from the key management system. Instead of implementing full MIKEY which combines authentication and key management in a complex integrated protocol, the invention separates these functions: the server handles authentication using standard protocols (EAP, PAP, CHAP, RADIUS), and then performs simple key delivery. This extraction reduces device complexity while maintaining security through proven authentication mechanisms.
Solution Approach 2:
The patent makes the server multi-functional by combining authentication server capabilities with key distribution server capabilities. The same server that performs authentication also delivers the network key, eliminating the need for separate key management infrastructure. This universality simplifies the overall system architecture while maintaining security through centralized control.
Data Source
AI summary
There is provided a communication device in which a network access authenticating unit executes a network access authentication process with an authentication server to establish a connection to a network, the authentication process including generation of information shared with the authentication server, a communication unit receives an authentication result message from the authentication server when succeeding in the network access authentication process, the authentication result message containing an authentication result indicating success in the network access authentication process and an encrypted network key; a key transport key generating unit generates a key transport key by use of the information generated in the network access authentication process; and a network key acquiring unit acquires a network key by decrypting the encrypted network key contained in the authentication result message with the key transport key, the communication unit encrypts data with the network key and transmits encrypted data to the network.