Key Processing Method for Flexible Asymmetric Encryption Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key update methods in asymmetric key encryption systems lack simplicity and flexibility, making them inefficient in managing key leakage and updating private keys effectively.
Innovation Solution
A method and apparatus for key processing that involve obtaining an update parameter from a security device to generate a user's private key by using previous key parameters and time index values, allowing for flexible key updates without increasing key length, using bilinear mapping and cyclic groups for secure and efficient key generation and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key update is performed by dividing life cycle into multiple time segments with intrusion tolerance technology, then security against key leakage is improved, but complexity of key update operation increases
Solution Approach 1:
The patent divides the key life cycle into multiple time segments (first time segment, second time segment, etc.) and generates different private keys for each segment. This segmentation allows the system to limit the impact of key leakage to a single time segment while maintaining security across the entire life cycle, thus improving reliability without requiring complete redesign of the key management system.
Solution Approach 2:
The patent implements dynamic key update by automatically generating new private keys at predetermined time points during the key life cycle. The system transitions from static key usage to dynamic key rotation, where keys are automatically updated based on time segment progression. This dynamic approach maintains security while simplifying operations through automated key management.
2Reliability
If frequent key updates are performed to reduce harm from key leakage, then security is improved, but operational simplicity deteriorates
Solution Approach 1:
The patent performs preliminary key generation during certificate issuance, creating multiple private keys for different time segments in advance. The certificate contains embedded information about these pre-generated keys and their valid time segments. This preliminary action eliminates the need for complex real-time key generation and update operations, maintaining security while simplifying subsequent key update operations.
Solution Approach 2:
The system enables self-service key management where the terminal device can automatically select and use appropriate private keys based on the current time segment without requiring manual intervention or complex coordination with the certificate authority. The certificate itself contains the necessary information for the device to autonomously manage key updates, improving ease of operation.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Embodiments of the present application provide a key processing method and apparatus, where the method includes: obtaining, by a user equipment, a private key update message provided by a security device, where the private key update message includes an update parameter generated when the security device enters an rth time sub-segment of an ith time segment; generating, when r is 0, a user's private key of the rth time sub-segment of the ith time segment by using the update parameter, a user's private key of a last time sub-segment of an (i-1)th time segment, and time index values of the rth time sub-segment of the ith time segment and the last time sub-segment of the (i-1)th time segment; and generating, when r is greater than 0, the user's private key of the rth time sub-segment of the ith time segment by using the update parameter, a user's private key of an (r-1)th time sub-segment of the ith time segment, and time index values of the rth time sub-segment and the (r-1)th time sub-segment of the ith time segment; The embodiments of the present application improve flexibility of updating a key, and simplify operations.