Key Generation System for Secure Mesh Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional encryption methods for networks, such as single group-keyed and pair-wise keying, are inadequate in hostile environments due to vulnerabilities like key compromise and memory impracticality in large mesh networks, where a single compromised gateway can lead to decryption and spoofing issues.
Innovation Solution
A Symmetric Key Generation System (KGS) using a pseudo-random function (PRF) and seed value to generate and distribute pair-wise keys efficiently, minimizing memory usage and preventing key compromise, with an epoch value for revocation and forward security, and collaborative key servers to manage secret data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pair-wise keying is implemented to improve security against gateway compromise, then security reliability is improved, but memory requirements increase quadratically with the number of nodes
Solution Approach 1:
The patent segments the key management system into multiple key servers, each responsible for a portion of the keying material. Instead of storing all n(n-1)/2 keys at each node, each node stores only O(k) secret data where k is the number of key servers. This segmentation reduces memory requirements from quadratic to linear while maintaining security through distributed key management.
Solution Approach 2:
The patent introduces key servers as intermediary entities that hold portions of the master keying material. These intermediaries enable secure key generation without requiring full key sets at each node. The key servers act as mediators that facilitate secure communication while reducing the memory burden on individual nodes through centralized key management.
2Device complexity
If a single group key is used for all network members to reduce key management complexity, then device complexity is reduced, but security reliability deteriorates when a gateway is compromised
Solution Approach 1:
The patent segments the single group key into multiple distributed key portions stored across key servers. Each node receives only its specific keying material from the distributed system, preventing single-point compromise. This segmentation maintains manageable complexity through automated key distribution while improving security through distributed key storage.
Solution Approach 2:
The patent implements local quality by giving each node its own unique keying material derived from the distributed master key, rather than using a uniform group key for all nodes. Each node's security is locally optimized with its own secret data, while the overall system maintains coordinated security through the distributed key structure. This allows individual node compromise without affecting other nodes.
Data Source
AI summary
Systems, methods, and other embodiments associated with key generation for networks are described. One example method includes configuring a key server with a pseudo-random function (PRF). The key server may provide keying material to gateways. The method may also include controlling the key server to generate a cryptography data structure (e.g., D-matrix) based, at least in part, on the PRF and a seed value. The method may also include controlling the key server to selectively distribute a portion of the cryptography data structure and/or data derived from the cryptography data structure to a gateway. The gateway may then encrypt communications based, at least in part, on the portion of the cryptography data structure. The method may also include selectively distributing an epoch value to members of the set of gateways that may then decrypt an encrypted communication based, at least in part, on the epoch value.