Cryptographic Communication Apparatus Reducing Computational Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing SSL/TLS cryptographic communication systems require complex public key infrastructure (PKI) for man-in-the-middle attack prevention, which is costly and operationally cumbersome, and PAKE authentication, while theoretically feasible, is difficult to implement due to the need for repeated public key cryptography operations.
Innovation Solution
A cryptographic communication apparatus that generates and encrypts random numbers using both public keys and passwords, reducing the load on devices by implementing public key encryption only once during the key exchange procedure, and using these encrypted random numbers for authentication within the SSL/TLS negotiation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PAKE authentication is implemented without modification in SSL/TLS cryptographic communication, then security against man-in-the-middle attack is improved, but computational load increases due to repeated public key cryptography operations
Solution Approach 1:
The patent combines SSL/TLS key exchange procedure with PAKE authentication into a unified process. The client and server perform both key agreement and password authentication simultaneously by integrating the PAKE protocol steps within the SSL/TLS handshake, eliminating the need for separate authentication operations after the initial key exchange.
Solution Approach 2:
The SSL/TLS handshake mechanism is enhanced to serve dual purposes: establishing cryptographic keys for secure communication and performing mutual authentication based on shared passwords. The same communication channel and cryptographic operations accomplish both key exchange and authentication functions that would traditionally require separate procedures.
2Reliability
If PKI mechanism is used for man-in-the-middle attack prevention, then security is improved, but operational complexity and maintenance costs increase
Solution Approach 1:
The patent replaces expensive, complex PKI infrastructure with simple password-based authentication. Instead of requiring digital certificates, certificate authorities, and complex verification mechanisms, the system uses inexpensive passwords that can be easily distributed and managed without dedicated infrastructure.
Solution Approach 2:
The authentication approach transitions from certificate-based verification to password-based verification. The fundamental parameter changes from verifying digital signatures against public key infrastructure to verifying shared secret knowledge, fundamentally simplifying the authentication mechanism while maintaining security against man-in-the-middle attacks.
Data Source
AI summary
There is provided a cryptographic communication apparatus for conducting a key exchange procedure with another cryptographic communication apparatus that shares a password. The apparatus includes a first encryption unit that encrypts information that is based on a first random number using a public key of the another apparatus, a second encryption unit that encrypts the information that is based on the first random number encrypted by the first encryption unit using the password, a third encryption unit that encrypts information that is based on a second random number using the first random number, and transmits a first signal and a second signal to the another apparatus, the first signal including the information that is based on the first random number encrypted by the second encryption unit, and the second signal including information that is based on the second random number encrypted by the third encryption unit.