Hub-Based Token Generation for Secure Channel Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication protocols like TLS are complex and inefficient for streaming data, imposing penalties due to additional features and being more suited for message-based transport, which can compromise security and data integrity, especially in scenarios requiring forward secrecy and protection against bit flips.
Innovation Solution
A protocol that authenticates session establishment messages using a pre-shared-secret, generating a key pair for secure communication channels, supporting both handshake and full negotiation styles, with key derivation based on a shared secret, ensuring forward secrecy and integrity through independent streams and message authentication codes, and utilizing a token-based mechanism for secure stream requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS protocol is used for secure communication, then data integrity and confidentiality are improved, but protocol complexity and overhead increase
Solution Approach 1:
The patent extracts and separates the authentication and key establishment functions from the full TLS protocol stack. It implements a simplified protocol that performs only the essential security functions (authentication via pre-shared secrets and key derivation) without the overhead of complete TLS message interleaving, sub-streams, and compression features, thereby reducing complexity while maintaining security.
Solution Approach 2:
The protocol segments the secure communication establishment into distinct phases: authentication phase using pre-shared secrets, key derivation phase generating unique keys for each direction and layer, and data transmission phase. This segmentation allows each phase to be optimized independently, reducing overall protocol complexity while maintaining security guarantees.
2Reliability
If TLS protocol is enabled for streaming data, then security is improved, but streaming performance deteriorates
Solution Approach 1:
The patent performs preliminary authentication and key establishment before the streaming data transmission begins. By completing the security handshake upfront using pre-shared secrets and deriving all necessary encryption keys in advance, the protocol eliminates the need for continuous security negotiations during streaming, thereby maintaining security while preserving streaming performance.
Solution Approach 2:
The protocol dynamically adapts to streaming requirements by implementing independent key derivation for send and receive directions, and separate key blocks for application messages and stream data. This dynamic key management allows efficient encryption/decryption operations tailored to streaming workloads without the overhead of message-based TLS protocols.
3Reliability
If full TLS negotiation is performed, then forward secrecy is improved, but establishment time increases
Solution Approach 1:
The patent implements preliminary key derivation from pre-shared secrets during the authentication phase, generating all necessary encryption keys before data transmission. This preliminary action achieves forward secrecy by ensuring that past session keys cannot be derived from current or future keys, while avoiding the time-consuming elliptic curve exchanges of full TLS negotiation.
Solution Approach 2:
The patent uses pre-shared secrets as an intermediary trust anchor that enables both parties to independently derive identical encryption keys without direct key exchange. This intermediary mechanism achieves the security goals of full TLS negotiation (including forward secrecy) while significantly reducing establishment time by eliminating the need for complex certificate verification and key exchange protocols.
Data Source
AI summary
Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity such as a hub to manage authentication, for example. In some instances, the third party may also perform endpoint selection (e.g., load balancing) by providing a particular endpoint along with the token.