Key Exchange Device Using Shared Secret Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key exchange protocols are vulnerable to attacks after a long-term secret key is leaked, allowing attackers to infer session keys, particularly in scenarios where a server or user's long-term secret key is compromised, leading to potential unauthorized participation in key exchanges.
Innovation Solution
Implementing a key exchange system that utilizes shared secret information, such as a MAC key, for authentication and falsification detection, ensuring that even if a long-term secret key is leaked, the session key remains secure by verifying authentication information using stored shared secret keys, thereby preventing unauthorized key exchanges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If a long-term secret key is stored in nonvolatile memory for key exchange, then key exchange can be performed over long term, but the long-term secret key may be leaked to attackers, allowing them to infer session keys
Solution Approach 1:
The system performs preliminary authentication using the shared secret key stored in nonvolatile memory before each key exchange session. This preliminary action verifies the legitimacy of participants and prevents attackers from successfully inferring session keys even if they obtain the long-term secret key, because the authentication fails at the preliminary verification stage
2Reliability
If shared secret information is used for authentication, then session key security is maintained after long-term key leakage, but the system complexity increases due to additional authentication mechanisms
Solution Approach 1:
The patent introduces a shared secret key as an intermediary authentication mechanism between the long-term secret key and the session key. This intermediary layer provides security verification without requiring complete redesign of the key exchange protocol, thus maintaining security while adding only necessary authentication components
3Reliability
If attackers obtain long-term secret keys through break-ins, then unauthorized participation in key exchange becomes possible, but implementing additional verification mechanisms increases operational burden on servers and users
Solution Approach 1:
The authentication mechanism uses the shared secret key stored in nonvolatile memory to perform self-verification of participant legitimacy. Each device independently verifies the other's authentication information using its own stored shared secret key, reducing the operational burden on servers and users while effectively preventing unauthorized participation
Data Source
AI summary
On the assumption that i ≠ s, j is the number of times a key exchange is performed, and k is any one of integers greater than or equal to 0 and less than j, a key exchange device includes: a shared secret key storage in which shared secret information mkik which is information different from a secret key of the key exchange device is stored; an authentication information addition unit that generates authentication information σi, by which authentication is performed and falsification is detected, for key exchange information ei, which is output to the outside, by using the shared secret information mkik; and an authentication information verification unit that receives key exchange information es and authentication information σs corresponding to the key exchange information es from the outside, verifies the authentication information σs using the shared secret information mkik, and, if the authentication information σs is not successfully verified, stops a key exchange, and the shared secret information mkik is a value that is used in a generation process in a key exchange.