Cryptographic Module Key Generation via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic key establishment and replenishment methods are burdensome, costly, and vulnerable to compromise, relying on established trust and non-compromised communication channels, and introduce significant overhead and performance issues, particularly in protocols like SSL and TLS, which are prone to man-in-the-middle attacks and require frequent handshaking.
Innovation Solution
A cryptographic module that generates cryptographic keys using temporary keys, cryptographic salts, and key parts, allowing for secure key exchange and agreement without over-the-air key exchange, reducing data transfer overhead and computational resources, and enabling secure and private communications through parallel computation and ephemeral session key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key encryption is used for secure key exchange, then security is improved, but computational overhead and memory requirements increase
Solution Approach 1:
The cryptographic key is segmented into multiple key parts that are distributed across different locations or storage media. This segmentation allows the system to use asymmetric encryption only for secure key part distribution while using more efficient symmetric encryption for the majority of cryptographic operations, thereby reducing overall computational overhead while maintaining security.
Solution Approach 2:
The system performs preliminary key establishment by securely distributing key parts in advance using asymmetric encryption. Once the key parts are established, the system transitions to using symmetric encryption for ongoing cryptographic operations, eliminating the need for repeated asymmetric encryption handshakes and reducing computational overhead for subsequent communications.
2Productivity
If symmetric key encryption is used for efficient data encryption, then computational efficiency is improved, but secure key exchange becomes difficult and vulnerable to compromise
Solution Approach 1:
The symmetric encryption key is segmented into multiple key parts that are distributed securely using asymmetric encryption. This allows the system to maintain the computational efficiency of symmetric encryption while improving security through the use of asymmetric encryption only for the initial key part distribution, rather than requiring the entire symmetric key to be exchanged securely.
Solution Approach 2:
The system uses asymmetric encryption as an intermediary mechanism to securely distribute key parts that will be used by symmetric encryption algorithms. The asymmetric encryption serves as a secure channel establishment tool, after which the more efficient symmetric encryption takes over for actual data protection, combining the security benefits of asymmetric encryption with the efficiency of symmetric encryption.
3Reliability
If frequent handshaking is performed for key replenishment, then security is improved, but data transfer overhead and communication time increase
Solution Approach 1:
The system performs preliminary key establishment by securely distributing key parts using asymmetric encryption. Once the key parts are established, they can be reused for multiple symmetric encryption operations without requiring frequent handshakes, thereby reducing communication time and data transfer overhead while maintaining security through periodic key replenishment when needed.
Solution Approach 2:
Instead of frequent handshaking, the system implements periodic key replenishment where key parts are securely distributed in advance and reused for multiple cryptographic operations. This periodic approach reduces the frequency of communication overhead while maintaining security through scheduled key updates rather than continuous handshaking.
4Reliability
If key parts are distributed across multiple locations, then security against compromise is improved, but device complexity increases
Solution Approach 1:
The cryptographic key is segmented into multiple key parts that are distributed across different locations or storage media. Each key part alone is insufficient to reconstruct the full key, providing security against compromise. The system manages this complexity through structured procedures for key part distribution, storage, and recombination, using asymmetric encryption to securely manage the key parts.
Solution Approach 2:
The system implements self-service mechanisms for key management where the cryptographic module automatically handles key part distribution, storage, and recombination using asymmetric encryption. This automation reduces the operational complexity of managing distributed key parts, as the system autonomously performs cryptographic operations without requiring complex manual intervention or coordination.
Data Source
AI summary
A cryptographic module has an input/output port to receive a first temporary key. A processor receives the first temporary key from the input/output port. A secure authentication key memory is connected to the processor. A temporary key generator is connected to the processor to produce a second temporary key for routing to the input/output port. A cryptographic salt generator is connected to the processor to produce cryptographic salt. A cryptographic key generator is connected to the processor to process key parts derived from the first temporary key, the second temporary key and the cryptographic salt to produce cryptographic keys.