ID-Based Authentication Key Exchange Protocol for IoT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ID-based authenticated key exchange (AKE) protocols with revocation functions require linear time to generate key update information and involve high calculation costs due to pairing calculations, making them inefficient for large-scale operations and resource-constrained devices like IoT devices.
Innovation Solution
The proposed ID-based AKE protocol incorporates a key generation device and equipment that utilize the KUNode algorithm for key update information generation and Schnorr signatures for latest private key generation, eliminating the need for pairing calculations and reducing time complexity independent of the number of users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pairing calculation is used in ID-based AKE protocol with revocation function, then authentication security is improved, but calculation cost increases
Solution Approach 1:
The patent extracts and removes the pairing calculation operation from the ID-based AKE protocol. By using traditional public key infrastructure with digital signatures instead of pairing-based cryptography, the solution eliminates the computationally expensive pairing operation while maintaining authentication security through standard cryptographic primitives.
Solution Approach 2:
The patent substitutes the pairing-based cryptographic mechanism with a traditional digital signature mechanism. Instead of using bilinear pairings on elliptic curves, the system uses standard public key cryptography with signature verification, replacing a complex mathematical mechanism with a more efficient and widely-supported alternative.
2Reliability
If existing ID-based AKE protocol with revocation function is used, then user revocation capability is improved, but time required to generate key update information increases linearly with number of users
Solution Approach 1:
The patent segments the key update information into two parts: a global key update component that is independent of the number of users, and individual user components that can be efficiently distributed. This segmentation allows the time-consuming key generation operation to be performed once globally rather than once per user, breaking the linear time complexity.
Solution Approach 2:
The patent performs preliminary key generation setup during an offline phase where the key generation center pre-computes cryptographic parameters and structures. This preliminary action enables online key updates to be generated efficiently without linearly scaling with the number of users, as the heavy computational work is done in advance.
3Adaptability or versatility
If ID-based AKE protocol is applied on IoT devices, then adaptability to resource-constrained devices is improved, but protocol efficiency deteriorates due to high calculation cost
Solution Approach 1:
The patent replaces expensive cryptographic operations (pairing calculations) with cheaper, more efficient operations (standard digital signatures and verification). This substitution makes the protocol suitable for resource-constrained IoT devices that cannot afford the high computational cost of pairing-based cryptography, while maintaining security through standard cryptographic mechanisms.
Data Source
AI summary
An authentication key exchange system according to one embodiment is an authentication key exchange system including a key generation device and a plurality of equipment. The key generation device includes a parameter generation unit configured to receive a security parameter 1λ and a total number N of the equipment as inputs, and output a master private key MSK, a master public key MPK, and an initial revoked user list RL; a static private key generation unit configured to receive the master private key MSK, the master public key MPK, and an identifier ID of the equipment as inputs, and output a static private key sskID corresponding to the identifier ID; a revoked user list update unit configured to receive the master public key MPK and a new revoked user list RL as inputs, increment a current time T, and update a revoked user list RLT at the current time T to the revoked user list RL; and a key update information generation unit configured to receive the master private key MSK, the master public key MPK, the current time T, and the revoked user list RL as inputs, and output key update information kuT at the current time T by using a KUNode algorithm. The equipment includes a latest private key generation unit configured to receive the master public key MPK, the static private key sskID corresponding to its own identifier ID, and the key update information kuT at the current time T as inputs, and output a latest private key cskID,T at the current time T without using pairing calculation; a temporary key generation unit configured to receive the master public key MPK and the latest private key cskID,T corresponding to its own identifier ID at the current time T as inputs, and output a temporary private key eskID and a temporary public key epkID; and a session key generation unit configured to receive the master public key MPK, its own identifier ID, an identifier ID′ of a communication partner, the latest private key cskID,T corresponding to its own identifier ID at the current time T, the temporary private key eskID corresponding to its own identifier ID, and a temporary public key epkID′ corresponding to the identifier ID′ of the communication partner as inputs, and output a session key SK shared with the communication partner.