Identity-Based Encryption for Aircraft File Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security mechanisms for ensuring the authenticity and integrity of computer files on aircraft are inadequate, particularly due to the need for frequent certificate updates and the limitations of Public Key Infrastructure (PKI) infrastructures, which are not well-suited for the long lifespan of commercial aircraft and complicate file security and flexibility.
Innovation Solution
The method employs identity-based encryption (IBE) using private keys generated based on the identity of entities, eliminating the need for certificates and incorporating a secondary signature for enhanced security, with the use of Gap Diffie-Hellman (GDH) schemes and elliptical curves for authentication, allowing for flexible and secure file verification without certificate management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Public Key Infrastructure (PKI) with certificates is used to ensure file security, then authenticity and integrity are guaranteed, but certificate management complexity and update frequency requirements increase
Solution Approach 1:
The patent extracts and eliminates the certificate management component from the security system by using identity-based encryption. Instead of requiring separate certificate files and revocation lists, the system derives cryptographic keys directly from entity identities, removing the burden of certificate issuance, distribution, and revocation management while maintaining security guarantees
Solution Approach 2:
The system enables entities to generate their own cryptographic key pairs based on their identities without requiring a certificate authority. Each entity independently manages their own private key and can verify authenticity through their identity-derived public key, eliminating the need for external certificate management infrastructure
2Reliability
If certificate revocation lists are regularly updated on aircraft, then security is maintained, but operational flexibility and productivity are reduced
Solution Approach 1:
The patent removes the certificate revocation list mechanism entirely by using identity-based encryption. Since security is based on mathematical derivation from identities rather than trusted certificate chains, there is no need for revocation lists or their periodic updates, eliminating the operational burden on aircraft systems
Solution Approach 2:
The system performs preliminary key generation based on identities before any file transfer occurs. By establishing security credentials in advance through identity-based key pairs rather than requiring ongoing certificate validation, the system eliminates the need for operational updates during aircraft missions
3Reliability
If root certificates are stored in secure hardware components, then security is strengthened, but access complexity and operational flexibility are reduced
Solution Approach 1:
The patent extracts the root of trust from hardware security modules and relocates it to the mathematical identity space. Instead of storing protected root certificates in secure elements, the system uses publicly known identity-based parameters, eliminating the need for hardware-based protection while maintaining security through cryptographic derivation
Solution Approach 2:
The patent introduces identity-based cryptographic parameters as an intermediary between the entity's identity and their cryptographic keys. This mediator allows public verification of authenticity without requiring access to protected root certificates, bridging the gap between security and operational flexibility
Data Source
AI summary
A method and system for processing or authenticating an operating computer file of an equipment item installed on board an aircraft. The method includes generating a first private key according to a scheme based on an identity of a first entity, the first private key being unique to the first entity. The method also includes signing the computer file using the first private key and transmitting the signed computer file to the aircraft through a network without a digital certificate that certifies the identity of the first entity. The method further includes verifying the signature of the signed computer file from a first public key determined according to a scheme based on the identity of the first entity, without using the digital certificate that certifies the identity of the first entity.