Content Distribution Key Exchange Through HTTP Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security architectures for transmitting key materials in content distribution networks, such as those used in mission critical services, lack sufficient security measures beyond HTTPS, particularly in scenarios involving HTTP proxies, which can compromise transport and integrity keys.
Innovation Solution
A system and method that involves encrypting user key material with a transport key (TrK) and optionally an integrity key (InK), and includes validating the encrypted response using the TrK-ID or InK-ID to ensure secure transmission, even when using HTTP proxies, by comparing decrypted identifiers with stored values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTPS encrypted communications are used to transmit key material, then basic security is provided, but additional security measures are needed to protect against HTTP proxy compromises
Solution Approach 1:
The patent segments the key material transmission into multiple protected components: transport keys (TrK) for confidentiality, integrity keys (InK) for data integrity, and authentication tokens for access control. Each component serves a specific security function, creating layered protection beyond basic HTTPS encryption.
Solution Approach 2:
The system performs preliminary security actions by pre-establishing transport keys and integrity keys before key material transmission. The client obtains authentication tokens in advance, and both parties validate each other's credentials before the actual key material exchange, preventing proxy interception.
2Adaptability or versatility
If key material is transmitted through HTTP proxies, then network flexibility is improved, but security is compromised
Solution Approach 1:
The patent introduces security intermediaries in the form of authentication tokens and signed requests that mediate between the client and server through HTTP proxies. These tokens act as secure pass credentials that proxies can verify without compromising the actual key material, maintaining both proxy flexibility and security.
Solution Approach 2:
Different security measures are applied at different stages: authentication tokens for proxy access, transport keys for encrypted transmission, and integrity keys for data verification. Each security mechanism operates locally at its appropriate point in the communication flow, providing targeted protection.
3Reliability
If additional security measures beyond HTTPS are implemented, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent creates universal security structures where authentication tokens serve multiple purposes: proving client identity to proxies, enabling secure key exchange, and providing audit trails. The same transport key infrastructure protects both confidentiality and integrity, reducing the need for separate dedicated mechanisms.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method and apparatus for providing user key material from a server to a client is disclosed. The method comprises receiving a first message from the client in a server, the first message having a user key material request, an access token and an identifier of a transport key (TrK-ID), validating the user key material request according to the access token, generating a response having user key material responsive to the user key material request, encrypting the response according to the transport key (TrK), and transmitting a second message comprising the response from the server to the client. The client decrypts the second message according to the transport key (TrK) and validates the second message using the identifier of the transport key (TrK-ID).