Encryption Protocol Negotiation via Subsession Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption-based authentication protocols face challenges in interoperability and user preference, particularly when different encryption algorithms are used by computing devices, leading to cumbersome manual notifications and scalability issues in large computer networks.
Innovation Solution
The system allows for negotiation of an encryption algorithm between client and server computers, enabling them to switch to a selected encryption algorithm using a subsession key for future communications, thus facilitating interoperability and user preference without disrupting standard authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual notification is used to inform devices of encryption algorithm differences, then interoperability between devices using different encryption algorithms is achieved, but device complexity and operational burden increase significantly
Solution Approach 1:
The system enables devices to automatically negotiate and agree upon encryption algorithms without manual intervention. The client and server autonomously exchange capability information and select compatible algorithms, eliminating the need for administrators to manually configure notification lists on each device.
Solution Approach 2:
The encryption algorithm selection becomes dynamic rather than static. Devices can adaptively choose from multiple supported algorithms based on real-time negotiation, allowing the system to flexibly respond to different algorithm capabilities without requiring pre-configured manual notifications for each possible algorithm combination.
2Adaptability or versatility
If multiple encryption algorithms are supported across devices, then user preference and adaptability improve, but authentication protocol complexity increases
Solution Approach 1:
The authentication protocol is segmented into distinct phases: capability exchange, algorithm negotiation, and authentication execution. This modular approach allows the system to handle multiple algorithms systematically by separating the negotiation logic from the core authentication mechanics, reducing overall protocol complexity despite supporting multiple algorithms.
Solution Approach 2:
The patent introduces an intermediary negotiation mechanism that mediates between the client's preferred algorithm and the server's supported algorithms. This intermediary layer resolves algorithm selection conflicts without requiring complex direct interactions between all possible algorithm combinations, simplifying the overall authentication protocol structure.
3Productivity
If encryption algorithm negotiation is implemented in large computer networks, then scalability improves, but communication overhead and time consumption increase
Solution Approach 1:
Devices perform preliminary capability exchange early in the connection process, identifying supported encryption algorithms before the actual authentication occurs. This preliminary action allows the negotiation to be completed in advance, minimizing the time impact on subsequent authentication operations and enabling scalable deployment across large networks.
Solution Approach 2:
The system efficiently manages the negotiation process by dynamically adjusting parameters such as algorithm selection and key lengths based on device capabilities and security requirements. This parameter-based approach allows for optimized negotiation routines that reduce communication overhead while maintaining scalability across networks of varying sizes.
Data Source
AI summary
Systems and methods for negotiating an encryption algorithm may be implemented in the context of encryption-based authentication protocols. The invention has the added benefit of providing a system an method that need not interfere with the standard operation of authentication protocols. A first computer, or client computer, can send a negotiation request to a second computer, or server computer. The negotiation request can specify that the client computer supports a selected encryption algorithm. In response, the server computer can return a subsession key for encryption using the selected encryption algorithm. Both client and server may then switch to encryption in the selected encryption algorithm, using the subsession key to encrypt future communications.