Edge Mutual Authentication Using Dynamic Ephemeral Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In edge computing scenarios, physical security challenges expose edge devices to untrusted parties, risking the exposure of sensitive information such as private keys and certificates used for mutual authentication.
Innovation Solution
An information handling system dynamically generates cryptographic keys using a physical identifier and biological identifier, along with a timestamp, to create a PKI certificate for mutual TLS authentication, ensuring secure communication without persistent storage of secret information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional mutual authentication using persistent private keys and certificates is used, then authentication functionality is achieved, but security is compromised due to physical access risks at edge devices
Solution Approach 1:
The patent implements dynamic key generation where cryptographic keys are created on-demand using physical identifiers, biological identifiers, and timestamps rather than relying on persistent stored keys. The keys exist only temporarily in memory during the authentication process, transforming the static key storage model into a dynamic one that automatically expires after use.
Solution Approach 2:
The patent employs disposable cryptographic keys that are generated for single-use authentication and then discarded. Instead of relying on long-lived private keys that must be securely stored, the system creates ephemeral key pairs that exist only momentarily to perform the authentication handshake, eliminating the need for persistent secret storage.
2Reliability
If dynamic key generation is implemented to improve security, then resistance to physical attacks is enhanced, but computational overhead increases
Solution Approach 1:
The system performs preliminary computation by pre-generating cryptographic keys from stable physical identifiers and biological identifiers stored in secure elements. These base identifiers are processed once to create authentication credentials, avoiding the need for repeated heavy cryptographic operations during each authentication event.
Solution Approach 2:
The authentication system is self-service in that it automatically generates cryptographic keys from inherent device characteristics (physical identifiers) and biometric data without requiring external key distribution infrastructure. The device itself serves as its own key generation authority, eliminating the need for secure key transport and distribution mechanisms.
Data Source
AI summary
An information handling system may include at least one processor and a memory. The information handling system may be configured to receive, from a second information handling system, a physical identifier, a biological identifier, and a timestamp; determine a public key and a private key for the second information handling system based on the physical identifier, the biological identifier, and the timestamp; generate a random message; encrypt the random message with the public key for the second information handling system; transmit the encrypted random message to the second information handling system; and in response to a determination that the second information handling system has successfully decrypted the random message, authenticate the second information handling system.