Key Management Server Device-Unique Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ticket-based key management systems fail to provide an efficient and secure solution for scenarios where a user's communication session is forked to multiple devices, leading to issues with key management, accountability, and reliability, especially when multiple devices share the same subscription or require different keys for security.
Innovation Solution
A method where a Key Management Server generates a device-unique key for each device associated with a user identity by using a modifying parameter, which can be a pseudo-random number, identity, or other parameters, allowing secure communication and authentication between devices without requiring a pre-existing public key infrastructure or shared keying material.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single key is shared among multiple devices in a forking scenario, then key management is simplified, but security and accountability are compromised
Solution Approach 1:
The patent segments the single shared key into multiple device-specific keys. Each device associated with a user identity receives a unique key derived from a modifying parameter specific to that device. This segmentation maintains simplicity in key distribution (the KMS still issues one key per device) while enhancing security and accountability (each device has its own cryptographic identity).
Solution Approach 2:
The patent applies local quality by making each device's key unique to that specific device through the use of device-specific modifying parameters. Instead of uniform key distribution, each device receives a key with local characteristics (device-specific) that enable individual identification and accountability while maintaining the overall system's simplified key management architecture.
2Measurement precision
If the KMS maintains state information for all valid tickets, then key distribution accuracy is improved, but storage space and reliability are worsened
Solution Approach 1:
The patent extracts the state management burden from the KMS by using modifying parameters that are either generated by or known to the receiving device. The KMS distributes keys based on these parameters without needing to track or maintain state information about each device's ticket status. This extraction maintains key distribution accuracy (the KMS can still verify tickets) while eliminating the complex state management requirement.
3Quantity of substance
If a short ticket lifetime is used, then KMS storage requirements are reduced, but the system cannot handle long-duration scenarios such as vacation messages
Solution Approach 1:
The patent enables self-service by allowing devices to independently generate or obtain modifying parameters that are valid for the entire ticket lifetime. The KMS does not need to store or manage ticket validity information because the device-specific keys are derived from parameters that inherently encode the ticket's scope and duration. This self-service approach reduces KMS storage requirements while maintaining adaptability to various ticket lifetimes including long-duration scenarios.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A method and apparatus for key management in a communication network. A Key Management Server (KMS) receives from a first device a request for a token associated with a user identity, the user identity being associated with a second device. The KMS then sends the requested token and a user key associated with the user to the first device. The KMS subsequently receives the token from the second device. A second device key is generated using the user key and a modifying parameter associated with the second device. The modifying parameter is available to the first device for generating the second device key. The second device key is then sent from the KMS to the second device. The second device key can be used by the second device to authenticate itself to the first device, or for the first device to secure communications to the second device.