Fabric Key E2EE for Wireless Data Without Server Key Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for transmitting and receiving encrypted data through a cloud server are vulnerable to security breaches if the cloud server is compromised, as the encryption keys can be hacked, exposing the data to external devices.
Innovation Solution
Implementing a fabric network with end-to-end encryption (E2EE) that generates a fabric key based on pre-stored device keys and member keys, shared among fabric network entities, allowing secure encryption and decryption of data without exposing the keys to a service server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted through a cloud server using SSL or TLS protocols, then data transmission security is improved, but the encryption keys are exposed to the cloud server which may be hacked
Solution Approach 1:
The patent extracts the encryption key management from the cloud server by implementing end-to-end encryption where keys are generated and stored locally in electronic devices rather than being centralized on the server. The server only handles encrypted data, not keys, thereby removing the vulnerability of key exposure at the server level.
Solution Approach 2:
The patent introduces an intermediary key derivation mechanism where a fabric key is generated based on device-specific keys and member keys, acting as a mediator between the device keys and the encrypted data. This fabric key enables decryption without exposing the original device keys to the cloud server.
2Ease of operation
If a cloud server stores and manages encrypted data, then data accessibility and service management are improved, but the server becomes a single point of failure for key security
Solution Approach 1:
The patent segments the key management functionality from the data management functionality. The cloud server is responsible only for storing and transmitting encrypted data, while key generation, storage, and management are segmented to individual electronic devices and their associated fabric keys, creating separate security domains.
Solution Approach 2:
The patent applies local quality by making each electronic device have its own unique device key and generating device-specific fabric keys. This ensures that even if one device's keys are compromised, other devices remain secure, and the cloud server cannot decrypt any data without the specific device's fabric key.
3Device complexity
If encryption keys are centralized on a cloud server, then key management is simplified, but security is compromised when the server is attacked
Solution Approach 1:
The patent implements self-service by enabling each electronic device to autonomously generate its own device key, member key, and fabric key without requiring centralized key distribution from the cloud server. Devices independently manage their own encryption credentials, eliminating the need for the server to handle sensitive key material.
Solution Approach 2:
The patent applies preliminary action by pre-generating device keys in each electronic device before data transmission occurs. The fabric key is derived in advance from the device key and member key, so that when encrypted data is received, the device can immediately decrypt it without requiring any key exchange or server intervention during the decryption process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided is a method for a first electronic device connected to a fabric network supporting end-to-end encryption (E2EE) in a wireless communication system. The method comprises the operations of: generating a fabric key on the basis of a pre-stored first device key and a second member key received from a second electronic device; transmitting the fabric key to the second electronic device through a fabric server managing the fabric network and a service server managing service data; encrypting the service data on the basis of the fabric key; and transmitting the encrypted data to the second electronic device through the service server, wherein the fabric key is shared between the fabric server, which is a member entity of the fabric network, and the second electronic device, and the encrypted data may be decrypted by the member entity of the fabric network that shares the fabric key.