Key Generation Using Segmented Factors to Prevent Gateway Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network security, gateway devices risk data leakage during data forwarding between terminal devices and public network servers due to the need to decrypt and re-encrypt data, compromising security and potentially leading to illegal data capture.
Innovation Solution
A key generation method where a first key factor and a second key factor are both encrypted with an initial key, ensuring the gateway device remains unaware of these factors, and a shared key is generated between the devices using these factors, ensuring secure data transmission without the gateway's knowledge of the shared key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the gateway device decrypts and re-encrypts data during forwarding, then data can be transmitted through the gateway, but the gateway device risks leaking data information
Solution Approach 1:
The encryption key is segmented into two separate key factors (first key factor and second key factor) that are distributed to different devices. Neither the gateway device nor any single device possesses the complete decryption capability, as both key factors are required to reconstruct the shared key. This segmentation prevents the gateway from accessing plaintext data while still enabling secure forwarding.
Solution Approach 2:
A key factor distribution mechanism is introduced as an intermediary system that securely delivers key factors to terminal devices without exposing them to the gateway. The gateway acts merely as a transparent transporter of encrypted data, while the key management intermediary ensures that decryption capabilities remain distributed and secure.
2Reliability
If a shared key is established between terminal device and server, then secure communication is achieved, but the gateway device may acquire the shared key
Solution Approach 1:
The shared key generation process is segmented so that terminal devices independently generate their own key factors and combine them with received key factors to derive the shared key. The gateway device only handles encrypted data and never receives the key factors or the final shared key, eliminating the risk of key exposure at the gateway.
Solution Approach 2:
Key factors are pre-distributed to terminal devices through secure channels before the actual communication begins. This preliminary distribution ensures that only the intended terminal devices possess the necessary components to generate the shared key, preventing unauthorized entities including the gateway from acquiring the key.
3Adaptability or versatility
If the gateway device forwards data between secure channels, then network connectivity is maintained, but data may be illegally captured
Solution Approach 1:
The encryption architecture is segmented into multiple layers where the gateway operates at the encrypted data level without access to the application-layer shared key. Terminal devices perform end-to-end encryption using their derived shared keys, while the gateway merely forwards encrypted packets, creating multiple security layers that prevent illegal capture at the gateway.
Solution Approach 2:
The system introduces encrypted data as an intermediary form that can be safely handled by the gateway without decryption. The gateway forwards this intermediary encrypted form between terminal devices and servers, while the actual meaningful data remains protected in both transmission and storage at the gateway.
Data Source
AI summary
The disclosure provides a key generation method and apparatus. The key generation method comprises: encrypting a first key factor generated by a first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor. According to the disclosed embodiments, a gateway device is unable to acquire a shared key negotiated between a first device and a second device, ensuring the security of data transmitted there between, and further reducing the risk of data being illegally captured during transmission.