Diversified Secure Channel for Multi-Entity Data Encryption

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for secure data exchange between electronic devices, such as the SCP03 protocol, are inefficient when transmitting the same data to a large number of entities, as they require preparing a dedicated encrypted version for each device, which is impractical and resource-intensive.

Innovation Solution

Implementing a diversified secure channel using a second cryptographic key, allowing for a different encryption protocol mode (predictive or broadcast mode) to efficiently encrypt data intended for multiple electronic entities, thereby reducing the need for individualized encryption for each device.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a dedicated encrypted version is prepared for each electronic entity using SCP03 protocol, then data confidentiality is ensured, but the complexity and resource consumption increase significantly when transmitting to a large number of entities

Engineering Contradiction:
Improvedata confidentialityVSAvoidencryption process complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the encryption process into two distinct phases: (1) a setup phase where a first secure channel establishes a second cryptographic key, and (2) a data transmission phase where the second key encrypts data for multiple entities. This segmentation allows the complex key establishment to occur once, rather than repeatedly for each entity.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary action by establishing the second cryptographic key through the first secure channel before the actual data transmission to multiple entities. This pre-established key can then be reused across multiple transmission sessions, eliminating the need to re-establish secure channels repeatedly.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If individual encryption is performed for each electronic entity, then secure communication is maintained, but the time and resources required for data distribution increase

Engineering Contradiction:
Improvesecure communicationVSAvoiddata distribution time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The second cryptographic key serves a universal function across multiple electronic entities and multiple transmission sessions. Once established through the first secure channel, this single key can encrypt data intended for any number of entities, making the encryption system multi-functional rather than requiring separate encryption mechanisms for each entity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent merges multiple encryption operations into a single key establishment process. Instead of performing separate key exchanges and encryptions for each entity, the system combines these operations by establishing one second key that serves all entities, thereby reducing total transmission time and resource consumption.

Inventive Principle:
Principle #5Merging (Combining)

3Productivity

If a single cryptographic key is used for all entities, then resource usage is minimized, but the security and confidentiality of data transmission are compromised

Engineering Contradiction:
Improvedata transmission efficiencyVSAvoiddata confidentiality
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent introduces a dimensional hierarchy in the key structure: a first cryptographic key (entity-specific) protects a second cryptographic key (universal), which in turn protects the transmitted data. This layered dimensional approach allows efficient universal encryption while maintaining security through the outer layer of entity-specific key protection.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The first secure channel acts as an intermediary, establishing the second cryptographic key in a protected manner before it is used for universal data encryption. This intermediary mechanism ensures that the efficient second key is itself protected by the secure first channel, combining efficiency with security.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3395040B1Method of receiving data within an electronic entity and associated electronic entity
Publication Date: 2023.08.16 IDEMIA FRANCE SAS
  • EP3395040B1 patent drawingFigure 1~4
  • EP3395040B1 patent drawingFigure 2
  • EP3395040B1 patent drawingFigure 5

AI summary

A method for receiving data (DATASEND) within an electronic entity (2) comprises the following steps: - establishment, between the electronic entity (2) and an external electronic apparatus, of a first secure channel by encipherment by means of a first cryptographic key (SK-ENC); - reception, via the first secure channel, of a first command; - reception of at least one second cryptographic key (BK-ENC) via the first secure channel; - setting up, owing to the execution of said command, of a second secure channel by encipherment by means of the second cryptographic key (BK- ENC); - reception of said data (DATASEND) in the second secure channel. A corresponding electronic entity is also described.