Constrained Proxy Key Generation for Secure Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication methods using asymmetric key cryptography are computationally costly and lack the ability to effectively constrain proxy access, making it difficult to manage and limit the actions of a third-party proxy device in secure communication scenarios.
Innovation Solution
A method is introduced that generates and uses constrained proxy keys, where a first proxy key and a second proxy key are independently generated using a key derivation function based on a shared secret key and constraints, allowing for secure communication while restricting the proxy device's access and operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key cryptography is used for secure communication between parties, then security is improved, but computational cost increases
Solution Approach 1:
The patent segments the cryptographic system into two parts: asymmetric key cryptography is used only for initial key exchange and authentication, while symmetric key cryptography is used for the actual communication data encryption. This segmentation allows the system to benefit from the security of asymmetric cryptography without its high computational cost for continuous communication.
Solution Approach 2:
The patent introduces a symmetric key as an intermediary that is established through asymmetric key cryptography. This symmetric key then mediates the actual communication process, providing both security and computational efficiency for data encryption and decryption operations.
2Adaptability or versatility
If a proxy certificate is issued to a third party, then the third party can act as a proxy, but it becomes difficult to limit the type of information the third party may receive or access
Solution Approach 1:
The patent applies local quality by embedding specific constraints within the proxy key itself, such as time validity periods, destination address restrictions, and information type limitations. This allows different parts of the proxy key to have different functional properties, enabling fine-grained control over what the third party can access and when.
Solution Approach 2:
The patent changes parameters of the cryptographic key to encode constraints directly into the key structure. By modifying key parameters such as validity time, destination addresses, and information categories, the system enables flexible proxy capabilities while maintaining ease of operation through automated constraint verification.
3Adaptability or versatility
If a proxy certificate is issued to a third party, then the third party can communicate with the second party, but it is difficult to limit how long the third party may act as a proxy
Solution Approach 1:
The patent applies preliminary action by pre-defining the duration and validity period of the proxy key before it is issued to the third party. The constraints including start time, end time, and validity period are established in advance, automatically limiting the proxy duration without requiring ongoing management.
Solution Approach 2:
The patent uses parameter changes by encoding time-related constraints directly into the proxy key parameters. The key includes validity period, start time, and end time parameters that automatically enforce duration limits on proxy access, making time-based control as easy as key generation.
Data Source
AI summary
A constrained proxy key is used to secure communications between two devices via an intermediary device. A first proxy key is generated at a host device (key generator device) based on a shared secret key, one or more constraints on the first proxy key, and a key derivation function. At least the shared secret key and key derivation function are known to the host device an a client device (authentication device). The first proxy key is sent to a proxy device to use in authenticating communications with the client device. An authenticated message is generated by the proxy device using the first proxy key and sent to the client device. The client device locally generates a second proxy key using the key derivation function, one or more constraints, and the shared secret key for authenticating the proxy device. The proxy device is authenticated if the client device successfully accesses the authenticated message from the proxy device using the second proxy key.