Encryption Information Transmission Terminal Dynamic Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems, such as those adhering to the ANSI C12.22 standard, face challenges in dynamically updating encryption keys without increasing communication traffic or processing volume, particularly in devices with low processing capacity like smart meters, which complicates secure communication over extended periods and burdens the system with excessive traffic and processing demands.
Innovation Solution
The implementation of a network system that uses the Extensible Authentication Protocol (EAP) and key management methods, including the generation and sharing of encryption keys (SMK-HH and SMK-EE) between a smart meter and a meter data management server, allowing for secure communication while minimizing traffic and processing overhead by integrating key management within the existing authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the same encryption key is used for a long time to continue communication, then communication continuity is maintained, but security is compromised as malicious third parties can guess the encryption key
Solution Approach 1:
The patent implements dynamic key management where encryption keys are automatically updated periodically or based on communication duration. The system transitions from static key usage to dynamic key rotation, ensuring that even if one key is compromised, the damage is limited to a specific time window. This resolves the contradiction by maintaining communication continuity through automated key management while enhancing security through periodic key changes.
Solution Approach 2:
The patent establishes key update mechanisms in advance, where new encryption keys are generated and distributed before the old keys become vulnerable. The system proactively manages key lifecycles including generation, distribution, activation, and revocation, preventing key guessing attacks by ensuring keys are replaced before they can be compromised through prolonged usage.
2Reliability
If encryption key exchange protocol such as IKE or TLS is used to set the encryption key after communication route is established, then security is improved, but communication traffic and processing volume are excessively increased
Solution Approach 1:
The patent combines key establishment with the existing ANSI C12.22 device registration process. Instead of separating routing establishment and key exchange into distinct protocols, the invention integrates encryption key distribution into the initial device registration message flow. This merging eliminates the need for separate key exchange protocols, maintaining security while avoiding additional communication traffic and processing overhead.
Solution Approach 2:
The patent makes the device registration message serve multiple functions: establishing routing information, authenticating devices, and distributing encryption keys. By designing a universal message structure that carries both routing and cryptographic information, the system achieves secure key management without increasing communication volume, as the same message packets perform multiple tasks simultaneously.
3Adaptability or versatility
If a meter device simultaneously carries out establishing routing information and exchanging encryption key, then device functionality is improved, but processing capacity is exceeded for embedded devices with low processing power
Solution Approach 1:
The patent segments the combined key management and routing establishment process into distinct, manageable steps within the device registration flow. Rather than attempting complex simultaneous operations, the invention divides the process into: (1) device identification and routing setup, (2) key generation and distribution, (3) key confirmation and activation. This segmentation allows embedded devices to process each step sequentially with minimal computational burden while achieving comprehensive functionality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The communication unit transmits and receives a communication message. The authentication processor performs an authentication process for establishing the network connection by transmitting and receiving an authentication message to and from an authentication server through the communication unit. The encryption information generator generates an encryption key shared with the authentication server when the authentication process is successfully completed. The first message generator generates a first communication message instructing the destination device to acquire the encryption key from the authentication server. The second message generator generates a second communication message including data to be transmitted to the destination device. The communication unit transmits the first communication message to the destination device, encrypts the second communication message with the encryption key, and transmits an encrypted second communication message to the destination device.