Intermediate Equipment Message Editing via Asymmetric Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In telecommunications, intermediate equipment on communication paths cannot modify or read encrypted data messages between end nodes due to encryption at the transport and application layers, limiting their ability to perform tasks like web optimization and filtering, and there is no secure way for authorized equipment to intervene without access to encryption keys.
Innovation Solution
A method where an intermediate equipment intercepts data messages, obtains a specific encryption parameter, determines a cryptographic element, modifies the message using this element, and transmits it securely to the second node, ensuring only authorized equipment can modify data and maintaining confidentiality by using unique encryption parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied at transport and application layers to secure communications between end nodes, then security and confidentiality are improved, but the ability of intermediate equipment to read and modify messages deteriorates
Solution Approach 1:
The encryption system is segmented into multiple independent encryption contexts, each with its own key pair. End nodes hold private keys while intermediate equipment holds corresponding public keys, allowing selective decryption and modification capabilities without compromising overall security
Solution Approach 2:
Public keys act as intermediaries that enable intermediate equipment to perform authorized operations on encrypted messages without having access to the private decryption keys held by end nodes
2Ease of operation
If intermediate equipment is given access to encryption keys to modify messages, then message modification capability is improved, but security and confidentiality deteriorate
Solution Approach 1:
The key management system is segmented so that private decryption keys remain exclusively with end nodes while intermediate equipment receives only public encryption keys, maintaining security boundaries while enabling authorized modification capabilities
Solution Approach 2:
Different types of equipment are assigned different key types based on their functional requirements: end nodes receive private keys for decryption and authentication, while intermediate equipment receives public keys for encryption and modification, creating localized security properties optimized for each role
3Ease of operation
If multiple equipment share the same encryption key to modify messages, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The key distribution system is segmented to provide each intermediate equipment with a unique public key derived from its own private key, eliminating shared secrets while maintaining operational simplicity through automated key management
Solution Approach 2:
Asymmetric cryptography is applied where each equipment type holds different key types (private vs public), creating inherent security differentiation that prevents unauthorized access while maintaining ease of operation through standardized key exchange protocols
Data Source
AI summary
The messages established on a communication path between two nodes are increasingly encrypted. However, the devices present on the communication path may intervene to transport the messages and to read, edit or add data in the messages. It may also be desirable that only “authorized” devices can carry out these actions. In order to intervene on these data, it would be necessary that the devices on the communication path have available all the keys used by the nodes to encrypt and decrypt the data of the messages, which is difficult to envisage. A modification method enables a device, capable of intercepting a data message on a communication path between two nodes, to edit the data under the control of the nodes, while ensuring that a device cannot access the data edited by another device on the path.