Layered Encryption for End-to-End Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
End-to-end encryption (E2EE) systems are vulnerable to unauthorized access when implemented on user devices, as data can be intercepted before encryption is applied, particularly on traditional keyboards and touch screen mobile devices lacking physical keyboards, which are more susceptible to attacks due to lack of native application encryption in pre-boot environments.
Innovation Solution
A layered encryption method using a keyboard System On A Chip (SOC) that generates public/private key pairs based on a random number, provisioned seed, or physical unclonable function (PUF), encrypts user input with the recipient's public key, and sends the encrypted data through a host computing device, providing an additional layer of security by encrypting data before it leaves the input device and supporting encryption in both pre-boot and post-boot environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted only at the host computing device level, then the encryption implementation is simple, but the security is compromised because data can be intercepted before encryption is applied
Solution Approach 1:
The encryption system is segmented into multiple independent layers: (1) input device-level encryption using local key pairs stored in secure element, (2) host computing device encryption using application-level key pairs, and (3) message manager encryption. Each layer operates independently with its own key management, creating a multi-layered security architecture where compromise of one layer does not expose the entire system.
Solution Approach 2:
Encryption is performed in advance at the input device before data leaves the keyboard. The system generates key pairs, encrypts data with the private key, and transmits the encrypted data along with the public key to the host. This preliminary encryption action ensures data is protected before it enters the potentially vulnerable host environment.
2Object-affected harmful factors
If encryption is performed at the input device level, then data protection against keyloggers is improved, but the device complexity increases
Solution Approach 1:
A secure element acts as an intermediary component within the input device architecture. This secure element specifically protects against keylogger attacks by isolating key pair generation and encryption operations from the main processor and operating system. The secure element creates a trusted execution environment that keyloggers cannot access, while still allowing the input device to function normally.
Solution Approach 2:
The input device incorporates localized security features including a secure element for key storage, local encryption capabilities, and on-device key pair management. These local quality enhancements provide targeted protection at the input device level without requiring complete redesign of the entire system architecture.
3Adaptability or versatility
If multiple key pairs are stored for different recipients, then multi-user concurrent messaging is enabled, but the storage requirements increase
Solution Approach 1:
The system dynamically manages key pairs based on communication needs. Instead of storing all possible recipient key pairs permanently, the system generates and stores key pairs on-demand for active communication sessions. The secure element maintains a limited set of active key pairs, with automatic rotation and expiration of unused keys, allowing multi-user support while constraining storage requirements.
4Reliability
If a new key pair is generated for each message, then forward secrecy is improved, but the computational overhead increases
Solution Approach 1:
The system implements periodic key pair generation rather than generating a new key pair for every single message. Key pairs are generated at scheduled intervals or for each communication session, providing forward secrecy at a manageable computational cost. This periodic approach balances security requirements with computational efficiency, avoiding the excessive overhead of per-message key generation while maintaining adequate forward secrecy.
Data Source
AI summary
Disclosed herein are methods, systems, and processes to provide layered encryption to facilitate end to end communication. A user input is displayed in a user interface of an input device. A public/private key pair is determined based on a random number, a provisioned seed, or a physical unclonable function (PUF) provided by the input device. A previous public/private key pair is stored in a storage device associated with the input device using a recipient public key as an index. The user input is encrypted with the recipient pubic key. The derived public key is sent as a header followed by the encrypted user input to a host computing device.