KEM Service Provisioning for Clients Without Signature Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in utilizing X.509v3 or C509 public key certificate-based key encapsulation mechanisms (KEMs) in environments where client devices support only digital signature validation, lacking the capability for digital signature generation, which is crucial for secure data protection post-processing.
Innovation Solution
A method involving a service provider device generating a service identifier and a shared secret, encapsulating it using the client's public key, and performing authenticated transmissions to ensure secure communication and verification, utilizing KEM-based techniques for authentication and key exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If X.509v3 or C509 public key certificate based KEMs are used in environments with constrained client devices, then secure data protection is achieved, but the client device capability requirements increase (requiring digital signature generation)
Solution Approach 1:
The service provider device acts as an intermediary that performs digital signature generation on behalf of the client device. The provider generates a service private key, signs the encapsulated shared secret and service identifier, and sends the signed response to the client. This mediator approach allows constrained client devices to use KEM-based services without having digital signature generation capabilities.
2Reliability
If digital signature generation is implemented on client devices, then object-bound security is enhanced, but device complexity and resource requirements increase
Solution Approach 1:
The digital signature generation functionality is extracted from the client device and relocated to the service provider device. The client device only needs to perform KEM operations (key pair generation, encapsulation, decapsulation) which are less resource-intensive than digital signature generation. This extraction reduces client device complexity while maintaining object-bound security through the provider's signed responses.
3Reliability
If post-quantum cryptography algorithms are used, then future security is improved, but compatibility with existing constrained devices deteriorates
Solution Approach 1:
The cryptographic functionality is segmented into two parts: KEM operations (key pair generation, encapsulation, decapsulation) performed by the constrained client device, and digital signature operations performed by the service provider device. This segmentation allows post-quantum KEM algorithms to be used for future-proof security while the heavier signature operations are handled by the provider, maintaining compatibility with constrained devices.
Data Source
Figure 1
AI summary
The invention relates to a method of providing a KEM-based service to a client device (2) by a service provider device (1), the method comprising the following steps: encapsulating a shared secret (4) using a public key of the client device (5) by the service provider device (1); first transmission of a first message (7) from the service provider device (1) to the client device (2); decapsulating the encapsulated shared secret (6) using a KEM private key of the client device (8) corresponding to the public key of the client device (5) by the client device (2).