Decentralized Key Management via Home Gateway Issuance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital rights management systems rely on centralized key management, which is vulnerable and requires insecure internet storage, making them unsuitable for secure content distribution across diverse devices.
Innovation Solution
A decentralized key management system using a home gateway as the issuer of terminal certificates, where local root CAs are generated and stored, shifting responsibility from a central authority to the end user, and utilizing a trusted platform module for secure key storage and generation of unique key pairs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If centralized key management using a central server is implemented, then key distribution and management can be automated, but security vulnerability increases and reliance on insecure internet storage occurs
Solution Approach 1:
The patent segments the centralized key management system into distributed home gateways, each managing keys locally for their respective networks. This eliminates the single point of failure at the central server while maintaining automated key distribution through the gateway network, thereby improving security without sacrificing automation.
Solution Approach 2:
The home gateway acts as an intermediary between the terminal and the external network, performing key generation and management locally. This intermediary structure enables automated key distribution while securing keys within the private network perimeter, resolving the contradiction between automation and security.
2Ease of manufacture
If centralized key management with root CAs stored on central servers is used, then certificate issuance can be streamlined, but storage security deteriorates due to internet accessibility
Solution Approach 1:
The patent extracts the root CA storage function from the centralized server and places it within the home gateway's local storage. This removes the harmful factor of internet-accessible key storage while maintaining the ability to issue certificates efficiently, as the gateway can still generate and distribute terminal certificates locally.
Solution Approach 2:
Each home gateway maintains local root CAs in its private storage, creating a localized certificate authority for its network. This local quality approach preserves certificate issuance efficiency while eliminating the security vulnerability of centralized internet-accessible storage, as keys never leave the local gateway.
3Reliability
If decentralized key management with local root CAs is implemented, then security and key rotation are improved, but system complexity increases
Solution Approach 1:
The home gateway is designed as a multi-functional device that performs routing, DNS, and now also local key management and certificate issuance. By consolidating these functions in the universal gateway, the patent avoids the complexity of separate decentralized key management servers while maintaining improved security and key rotation capabilities.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The invention is directed to a method for generating a pair of terminal associated keys comprising the steps of: providing (S100) on a home gateway (10) a pair of gateway associated keys comprising a public gateway key (Pub-G) and a private gateway key (Pr- G), providing (S110) on a terminal (20) a terminal associated and symmetric first terminal key (T-1) and accessing the public gateway key (Pub-G) and generating (S120) a second terminal key (T-2) by encrypting the first terminal key (T-1) with the public gateway key (Pub-G) on the terminal (20). In a further step (S130), the second terminal key (T-2) is transferred from the terminal (20) to the gateway (10) and a pair of terminal associated keys comprising a public terminal key (Pub-T) and a private terminal key (Pr-T) on the gateway (10) are generated (S140). The invention further includes the steps of generating (S150) an encrypted private terminal key (ePr-T) by encrypting the private terminal key (Pr-T) with the first terminal key (T-1) on the gateway (10), transferring (S160) the public terminal key (Pub-T) and the encrypted private terminal key (e Pr-T) to the terminal (20); and decrypting (S170) the encrypted private terminal key (ePr-T) with the first terminal key (T-1) and then with the public terminal key (Pub-T).