Key Server Election for Secure LAN Key Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for distributing a secure group key in a local area network (LAN) require manual installation and extensive messaging, which is inefficient and prone to errors.
Innovation Solution
A system where a single key server generates and distributes a secure association key (SAK) to all devices in the network, using a long-term connectivity association key (CAK) for encryption, with automatic election of a new key server when necessary, and periodic refresh of the SAK to ensure secure data communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual key distribution is used, then key security is maintained, but key management complexity and time consumption increase
Solution Approach 1:
A key server is pre-configured and maintained with master keys and key generation capabilities. The system performs preliminary key generation and storage actions, so when devices need keys, they are already available for immediate distribution, eliminating manual key management time
Solution Approach 2:
A key server acts as an intermediary between key generation and distribution. It receives key generation requests, generates keys using secure algorithms, and distributes them to authorized devices automatically, replacing manual key distribution while maintaining security through controlled access
2Extent of automation
If all devices broadcast information to generate group keys, then key generation is automated, but messaging overhead and network traffic increase
Solution Approach 1:
The key generation function is extracted from individual devices and centralized in a key server. Instead of all devices broadcasting information to each other, only the key server generates keys and distributes them selectively, dramatically reducing network messaging overhead while maintaining automation
Solution Approach 2:
The key server serves as an intermediary that receives automated key generation requests from devices and provides keys through controlled distribution. This eliminates the need for devices to broadcast information to all other devices, reducing messaging from O(n²) to O(n) while preserving automation
3Device complexity
If a single key server is used, then key management is simplified, but system availability decreases when the key server becomes unavailable
Solution Approach 1:
Each device maintains local copies of essential keying material and can locally generate or retrieve keys from backup sources. This local capability ensures that even if the central key server becomes unavailable, devices can continue to function with their locally stored key information
Solution Approach 2:
The system implements backup key storage and redundancy mechanisms in advance. Key servers maintain backup key copies, and devices store fallback keying material, providing a cushion against key server unavailability before it occurs, ensuring continuous system operation
Data Source
AI summary
The election of a key server is provided. The key server is a single device that broadcasts an encryption key to other devices in a network segment. Also, automatic reelection of a new key server is provided when a current key server becomes unavailable. Key receivers may separately detect that a new key server is needed and separately determine from state information which key receiver should be elected the new key server. The state information may have been received in previously sent messages. Thus, further messaging is not needed to elect a new key server.