Intermediate Unit Certificate Exchange for Secure Media Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks lack a solution for exchanging credentials between sender and receiver units to enable end-to-end protection of media data when it is sent via an intermediate unit, particularly in scenarios where the intermediate unit does not have access to the keying material for end-to-end integrity protection.
Innovation Solution
The solution involves an intermediate unit storing information associated with a certificate belonging to the receiver unit, which has been signed by the receiver unit, allowing the sender unit to verify the intermediate unit's authority and send protected data using this information for hop-by-hop protection, while maintaining end-to-end protection between the sender and receiver units.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end protection is implemented between sender and receiver, then confidentiality and integrity of media data are improved, but the intermediate unit cannot authenticate the sender or verify media data authenticity
Solution Approach 1:
The patent divides the security protection into two separate segments: end-to-end protection (confidentiality and integrity) and hop-by-hop protection (authentication and verification). This segmentation allows each security mechanism to operate independently with its own keying material, resolving the contradiction by enabling both functions simultaneously without interference.
Solution Approach 2:
The patent introduces an intermediary security context at the intermediate unit that mediates between the end-to-end protected data flow and the authentication requirements. This intermediary hop-by-hop security context allows the intermediate unit to perform authentication and verification functions without compromising the end-to-end protection, as it operates with separate keying material.
2Reliability
If hop-by-hop security context is established for authentication, then sender authentication and media data verification are improved, but end-to-end protection keying material may be exposed to intermediate units
Solution Approach 1:
The patent segments the security keying material into two distinct sets: one for end-to-end protection and another for hop-by-hop protection. This segmentation ensures that the intermediate unit only has access to hop-by-hop keying material for authentication purposes, while the end-to-end keying material remains securely held by the sender and receiver only, preventing exposure.
Solution Approach 2:
The patent applies local quality by assigning different security properties to different parts of the communication path. The hop-by-hop security context has authentication-focused properties at intermediate units, while the end-to-end security context maintains confidentiality and integrity properties exclusively between sender and receiver, with no keying material exposure at intermediate points.
3Reliability
If SRTP is used for media protection, then encrypted transport is achieved, but file transfer format forwarding is not supported and intermediate units cannot verify data authenticity
Solution Approach 1:
The patent segments the security functionality into separate layers: SRTP provides encrypted transport protection at the media layer, while the additional hop-by-hop security context provides authentication and verification capabilities at the network layer. This segmentation allows SRTP to maintain its encrypted transport function while the intermediate unit can independently perform authentication and forwarding operations using the hop-by-hop context.
Solution Approach 2:
The patent makes the intermediate unit multi-functional by equipping it with both hop-by-hop security context for authentication/verification and the capability to forward SRTP-protected media data. This universality allows the same intermediate unit to perform multiple functions (authentication, verification, and forwarding) simultaneously without conflict, resolving the adaptability issue.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A method of sending protected data from a sender unit to a receiver unit via an intermediate unit. The intermediate unit stores information associated with a certificate belonging to the receiver unit, and information associated with a certificate belonging to the intermediate unit, which has previously been signed by the receiver unit. The intermediate unit receives a request from the sender unit to send protected data to the receiver unit, and so it sends a response to the sender unit. The response includes the information associated with the certificate belonging to the receiver unit, which allows the sender unit to verify that the intermediate unit is authorised to receive data on behalf of the receiver unit. The intermediate unit then receives data from the sender unit that is protected using the information associated with the certificate belonging to the receiver unit for subsequent forwarding to the receiver unit. Having the receiver unit sign the intermediate unit's certificate allows the exchange of credentials to allow a sender unit to send protected data to a receiver unit via an intermediate unit.