Key Diversification via Public Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication systems require multiple base symmetric keys to be stored in memory for secure communication between entities, which is inefficient in terms of memory usage and may not be as secure as using public keys for key diversification.
Innovation Solution
Generating a derived key by combining a base symmetric key stored in a device with a public key from an asymmetric key pair, allowing multiple derived keys to be created using a single base symmetric key, and encrypting the derived key with the public key for secure transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple base symmetric keys are stored in memory for secure communication between entities, then security is improved, but memory usage increases
Solution Approach 1:
A single base symmetric key is designed to serve multiple functions by generating different derived keys for different communication entities. The base key acts as a universal root from which multiple entity-specific keys are derived through cryptographic operations combining the base key with entity identifiers or public keys, eliminating the need to store multiple separate base keys in memory.
Solution Approach 2:
The system changes the parameter of key storage from storing multiple complete keys to storing a single base key combined with variable parameters (entity identifiers, public keys). By changing only the derived key parameter while keeping the base key constant, the system achieves multiple secure communication channels without proportionally increasing memory storage requirements.
2Adaptability or versatility
If multiple base symmetric keys are stored in memory, then secure communication with multiple entities is enabled, but device complexity increases
Solution Approach 1:
The base symmetric key is designed as a universal key that can derive keys for any number of communication entities through a standardized derivation process. This eliminates the need for complex key management systems that would otherwise be required to generate, store, and manage multiple independent base keys for different entities.
Solution Approach 2:
The base symmetric key is pre-established and stored securely in the device. This preliminary action allows the device to dynamically generate appropriate derived keys for any communication entity without requiring pre-stored keys for each entity, simplifying the key management structure and reducing device complexity.
3Quantity of substance
If a single base symmetric key is used to generate multiple derived keys, then memory usage is reduced, but security may be compromised
Solution Approach 1:
The cryptographic key hierarchy is segmented into a base symmetric key and entity-specific derived keys. The base key provides the foundational security, while each derived key is segmented to be specific to a particular communication entity through combination with entity identifiers or public keys. This segmentation ensures that compromise of one derived key does not affect the base key or other derived keys.
Solution Approach 2:
Entity identifiers or public keys serve as intermediaries between the base symmetric key and the final derived keys. These intermediaries add an additional layer of security by ensuring that even if the base key is compromised, the derived keys remain protected by the unique intermediary parameters. The intermediary prevents direct mapping between the base key and any single derived key.
Data Source
AI summary
A symmetric key that is stored at a device may be received. A public key from a remote entity may also be received at the device. Furthermore, a derived key may be generated based on a one way function between the symmetric key that is stored at the device and the public key that is received from the remote entity. The derived key may be encrypted with the public key and transmitted to the remote entity. The encryption of the derived key with the public key may provide secure transmission of the derived key to an authorized remote entity with a private key that may be used to decrypt the encrypted derived key.