Dynamic Cryptographic Scheme Switching in Cipher Engines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptography systems require significant changes and downtime to adapt to new encryption keys or partners, making them inefficient for real-time, high-volume communications over public mediums like the Internet.
Innovation Solution
Implementing a system where cipher engines on a computing system can dynamically switch between multiple cryptographic schemes by propagating new identifiers and keys, allowing for seamless transitions without interrupting operations, and enabling the acceptance of messages encrypted with different schemes within a defined time window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic software is modified to use new encryption keys or schemes, then security is improved, but communication downtime increases
Solution Approach 1:
The cipher engine is designed to dynamically load and switch between different cryptographic schemes during runtime without requiring system restart. The configuration module can update encryption keys and algorithms on-the-fly, allowing the system to adapt to new security requirements while maintaining continuous communication operations
Solution Approach 2:
Multiple cryptographic schemes are pre-configured in the cipher engine before runtime. When a security update is needed, the system switches to a pre-loaded scheme rather than modifying existing code, eliminating downtime. The configuration module maintains a repository of pre-validated cryptographic configurations ready for immediate deployment
2Reliability
If different cryptographic software is developed for each communication partner, then security is improved, but device complexity increases
Solution Approach 1:
The cipher engine is designed as a universal cryptographic platform that can handle multiple communication partners and cryptographic schemes through a single unified interface. The configuration module manages different cryptographic configurations for different partners, allowing the system to provide partner-specific security without requiring separate software instances
Solution Approach 2:
The cryptographic functionality is segmented into modular components: a core cipher engine that handles encryption/decryption operations, a configuration module that manages cryptographic parameters, and a partner identification layer that routes to appropriate cryptographic schemes. This modular architecture reduces overall system complexity while maintaining security
3Adaptability or versatility
If cryptographic software is modified to handle new encryption schemes, then adaptability is improved, but productivity decreases
Solution Approach 1:
The cipher engine dynamically loads cryptographic schemes from external configuration files or modules without requiring recompilation or system restart. This allows the system to adapt to new encryption standards while maintaining continuous high-speed processing operations
Solution Approach 2:
The configuration module acts as an intermediary between the core cipher engine and external cryptographic standards. It translates various cryptographic schemes into a unified internal format that the engine can process efficiently, allowing adaptability without sacrificing processing throughput
Data Source
AI summary
A computer-implemented method is provided that includes propagating a first identifier and a first key to one or more cipher engines on a computing system, the one or more cipher engines configured to perform at least one of decryption and encryption based on a first cryptographic scheme from a plurality of cryptographic schemes identified by the first identifier, and the first key; on expiration of the first identifier and the first key, propagating a second identifier and a second key to the one or more cipher engines on the computing system and instructions for configuring the one or more cipher engines to change the first cryptographic scheme to a second cryptographic scheme based on the second identifier and the second key; and setting a time window beyond the expiration for acceptance of messages encrypted in the first cryptographic scheme and messages encrypted in the second cryptographic scheme.