Encrypted Client-Server Communication via Secure System Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional client-server communication methods end at the entry point into the backend, leaving the underlying systems insecure and vulnerable to attacks, as they do not provide end-to-end security and can be compromised if one system is broken, leading to potential manipulation of job lists and data.
Innovation Solution
Implementing a method where common cryptographic material is incorporated into both the client and the secure system, allowing derivation and transfer of key material for encrypted communication between the client and service systems, enabling end-to-end security and secure communication channels independent of entry points, using either symmetric or asymmetric cryptography.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional client-server communication methods are used with authentication ending at the entry point, then the authentication process is simple and straightforward, but the underlying systems become vulnerable to attacks and data manipulation
Solution Approach 1:
The patent segments the server into multiple independent service systems (job management system, telematics system, infotainment system) behind the entry point. Each service system has its own encrypted communication channel with the client, so if one system is compromised, the others remain secure. This segmentation resolves the contradiction by improving overall security reliability while maintaining manageable complexity through modular design.
Solution Approach 2:
The patent implements preliminary action by establishing encrypted communication channels between the client and each service system before any data transmission occurs. The encryption keys are derived and distributed in advance through the secure system, ensuring that when communication begins, security is already in place. This prevents attacks during data transmission while keeping the encryption system structure clear and manageable.
2Reliability
If end-to-end encrypted communication channels are established between client and each service system, then security is improved and systems become independent, but the key distribution and management complexity increases
Solution Approach 1:
The patent introduces a secure system as an intermediary that acts as a key distribution center. This secure system stores the master encryption key and automatically derives and distributes individual encryption keys to the client and each service system as needed. This intermediary approach resolves the contradiction by enabling independent encrypted channels for each service system while centralizing key management to prevent complexity from escalating.
Solution Approach 2:
The patent uses parameter changes by deriving different encryption keys from a single master key through cryptographic key derivation functions. Each service system receives a uniquely derived key based on its identity, while the client receives corresponding keys. This allows the system to maintain independence of communication channels while managing keys through a unified master key, thus improving reliability without proportionally increasing distribution complexity.
3Reliability
If authentication is performed only at the entry point, then the authentication process is fast and efficient, but the job list and data origin cannot be authentically verified
Solution Approach 1:
The patent applies preliminary action by establishing encrypted authentication channels between the client and each service system before data transmission. The client authenticates directly with each service system through these pre-established secure channels, enabling real-time verification of data origin (such as job list authenticity) without requiring additional authentication steps during data exchange. This improves data authenticity verification while keeping the authentication process efficient through upfront channel establishment.
Data Source
AI summary
A method for implementing an encrypted client-server communication, wherein the server includes an entry point, service systems behind the entry point, and a secure system. The method includes incorporating common cryptographic material into the client and into the secure system, deriving key material from the common cryptographic material in the client for an encrypted communication between the client and a service system, deriving key material from the common cryptographic material in the secure system for an encrypted communication between the client and a service system, and transferring the key material into the service system or retaining the key material in the secure system.