Distributed Symmetric Key Exchange for Secure CAN And IoT Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Disruption of communications between entities in networks, such as vehicle nodes and IoT devices, due to the lack of authentication and encryption in protocols like the Controller Area Network (CAN) protocol, leading to potential hacking and unauthorized control, is a significant issue.
Innovation Solution
A method for distributed symmetric key generation and authentication among entities, where each entity creates a part of the key, broadcasts and receives encrypted parts from others, and generates the symmetric key using a shared secret and random numbers, ensuring secure communication and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a broadcast protocol like CAN protocol is used for communication between entities, then communication simplicity and ease of operation are improved, but security and reliability deteriorate due to lack of authentication and encryption
Solution Approach 1:
The patent applies preliminary action by pre-distributing secret keys to entities during configuration or resetting in a secure environment before the entities are deployed. This allows authentication and encryption to be established in advance, enabling secure communication without complicating the operational protocol. The secret is distributed beforehand so that when entities communicate, they can immediately use pre-established cryptographic credentials.
Solution Approach 2:
The patent introduces cryptographic intermediaries (secret keys, symmetric keys, encryption algorithms) that mediate between entities to provide security. These intermediaries enable authentication and encrypted communication while maintaining the simplicity of the underlying broadcast protocol. The cryptographic layer acts as an intermediary that adds security without requiring fundamental changes to the communication protocol structure.
2Reliability
If authentication and encryption are implemented in the communication protocol, then security and reliability are improved, but device complexity and difficulty of implementation increase
Solution Approach 1:
The patent segments the security implementation into distinct phases: secret distribution phase (during configuration/resetting), key generation phase, and communication phase. This segmentation allows complexity to be managed separately - the secret distribution occurs once in a controlled environment, while the communication phase uses simple cryptographic operations. The authentication and encryption functions are separated into distinct modular components that can be implemented independently.
Solution Approach 2:
The patent enables entities to perform self-service authentication and key management. Each entity independently generates its symmetric key using the pre-distributed secret and the random number from the key generation message. Entities autonomously authenticate themselves by verifying the digital signature on the key generation message and by mutual authentication using their generated symmetric keys. This self-service approach eliminates the need for complex centralized authentication servers.
3Reliability
If symmetric key generation requires coordination between all entities, then key security is improved, but communication time and productivity are reduced
Solution Approach 1:
The patent applies preliminary action by pre-distributing the secret to all entities before they are deployed. This preliminary setup enables rapid symmetric key generation later, as entities only need to combine the pre-distributed secret with a randomly generated number rather than coordinating complex key generation protocols in real-time. The time-consuming setup occurs once during configuration, not during operational key generation.
Solution Approach 2:
The patent uses partial action by having the broadcast entity generate only the random number portion of the symmetric key, while the other entities generate their own portions independently. Each entity contributes part of the key material (their random number combined with the secret), and the full symmetric key is reconstructed locally at each entity. This parallel partial key generation is more efficient than sequential coordination.
Data Source
AI summary
A method is provided for distributed symmetric key generation by a plurality of entities in a network comprising, for each entity, creating a part of the symmetric key, broadcasting the part of the symmetric key to each other entity of the plurality of entities, receiving parts of the symmetric key from each other entity of the plurality of entities, generating the symmetric key from the part of the symmetric key of the entity and at least some of the parts of the symmetric key of each other entity of the plurality of entities. An authentication method is also provided for authenticating a plurality of entities in a network