Derived Unique Recovery Keys Per Session Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure session recovery mechanisms, particularly in protocols like TLS, face inefficiencies and scalability issues due to the need for unique recovery keys for each session, which increases management costs and is vulnerable to quantum computing advancements.
Innovation Solution
The Derived Unique Recovery Keys per Session (DURKPS) mechanism generates a unique recovery key for each secure session using a sequence number and a base key, allowing thousands or millions of sessions to share the same key set, reducing management costs and maintaining symmetry for faster execution, even in a post-quantum era.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a unique recovery key is generated for each secure session, then session recovery reliability is improved, but key management complexity and costs increase
Solution Approach 1:
The patent segments the key management system into two parts: a long-lived base key stored securely in the recovery server, and short-lived session-specific recovery keys derived from the base key. This segmentation allows unique recovery capability for each session while centralizing long-term key management, reducing overall system complexity.
Solution Approach 2:
The patent extracts the long-term key management burden from individual session handlers by separating the base key (stored permanently in recovery server) from session-specific recovery keys (derived temporarily for each session). This extraction allows session recovery to proceed with simple key derivation rather than complex key management.
2Reliability
If asymmetric key mechanisms are used for session recovery, then security against quantum computers is improved, but execution time and computational overhead increase
Solution Approach 1:
The patent applies local quality by using symmetric key derivation (fast execution) for the bulk of session recovery operations, while reserving asymmetric cryptographic operations only for the initial base key establishment and verification. This localized use of asymmetric cryptography maintains quantum security where critical while minimizing performance impact.
Solution Approach 2:
The patent changes the cryptographic parameter regime by using a hybrid approach: asymmetric keys for long-term base key security (quantum-resistant) and symmetric key derivation for session-specific recovery (fast execution). This parameter change allows the system to achieve both quantum security and efficient execution time.
3Productivity
If multiple secure sessions share the same base key, then key management efficiency is improved, but security vulnerability to key compromise increases
Solution Approach 1:
The patent applies preliminary action by deriving session-specific recovery keys from the base key before actual session recovery operations. This pre-derivation ensures that even if the base key is compromised, the session-specific keys remain secure as they are derived with additional session-unique inputs (such as session identifiers or nonces), providing a preliminary security layer.
Solution Approach 2:
The patent provides beforehand cushioning by using the session-specific key derivation process as a protective buffer between the base key and session data. Even if the base key is compromised, an attacker cannot directly access session data without the additional session-specific inputs required for key derivation, providing a cushion of security against key compromise.
Data Source
AI summary
Examples described herein relate to systems, apparatuses, methods, and non-transitory computer-readable medium for recovering a session object associated with a secure session established by a security protocol server, including receiving, by a recovery server, an encrypted session object from the security protocol server, wherein the encrypted session object is unique to the secure session, generating, by the recovery server, a recovery key based on a first initial key and a recovery key sequence number, wherein the recovery key sequence number corresponds to a number of times that secure sessions have been established since the first initial key is received by the security protocol server, and decrypting, by the recovery server, the encrypted session object using the recovery key to generate the session object associated with the secure session.