Encryption Key Rollover via Handshake Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encryption key rollover in data networks are inefficient and lack seamless integration with hybrid keying materials, leading to potential security vulnerabilities and disruptions during key updates.
Innovation Solution
A method where two peering computers independently generate equivalent pairs of peer encryption keys using hybrid input keying material, verifying their equivalence through a handshake process, and deriving session encryption keys without requiring a control plane, enabling seamless key rollover and enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional key rollover methods are used, then key updates can be performed, but security vulnerabilities and disruptions occur during key updates
Solution Approach 1:
The patent performs preliminary key derivation and verification actions before actual key rollover. The initiator derives candidate session keys in advance, encrypts them with the responder's public key, and includes them in the handshake message. This preliminary preparation ensures that key updates can occur seamlessly without disrupting ongoing communications, resolving the contradiction between security reliability and update efficiency.
Solution Approach 2:
The patent introduces an intermediary handshake message that carries encrypted candidate session keys between the initiator and responder. This intermediary mechanism allows both parties to verify key equivalence and establish new session keys without direct exposure of the keys themselves, maintaining security while enabling efficient key rollover.
2Adaptability or versatility
If control plane is used for key management, then key distribution can be centralized, but protocol complexity increases
Solution Approach 1:
The patent enables the data path entities (initiator and responder) to autonomously perform key derivation, verification, and rollover operations using their own private keys and the exchanged public keys. Each party independently derives session keys and verifies equivalence through the handshake process without requiring external control plane intervention, thereby reducing protocol complexity while maintaining versatile key management capability.
Solution Approach 2:
The patent merges the key management functions directly into the data path communication protocol. The handshake message simultaneously serves multiple purposes: establishing communication, exchanging public keys, verifying key equivalence, and distributing session keys. This consolidation eliminates the need for separate control plane protocols, reducing overall system complexity.
Data Source
AI summary
There is provided a technique of establishing encryption keys for communication between 1st peer and 2nd peer via a data path. The technique comprises: by each peer, using input keying material to independently generate equivalent pairs of peer encryption keys (PEKs), verifying equivalence of the generated PEK pairs, and using by 1st peer and 2nd peer the verified PEK pairs to become in possession of equivalent pairs of session encryption keys (SEKs). Verifying comprises: generating by 1st peer a first handshake (HS) message encrypted by PEK Tx1 and sending the first HS message to the 2nd peer via the data path; decrypting by the 2nd peer the first HS message using the PEK Rx2, generating a second HS message encrypted by PEK Tx2, and sending the second HS message to the 1st peer via the data path; and decrypting the second HS message by the 1st peer using PEK Rx1.