M2M Secure Session Resumption via Symmetric Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine-to-machine (M2M) communication techniques require excessive data exchange during secure communication handshakes, particularly with the transmission of large digital certificates, which burdens constrained devices like IoT devices and increases the overhead in establishing and resuming secure communication sessions.
Innovation Solution
The proposed method reduces data exchange by using shared symmetric keys and session resumption handshakes, where cryptographic key data and session identifiers are used to establish and re-establish secure communication sessions without the need for full TLS/DTLS handshakes, and credential data is stored and accessed efficiently to minimize data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full TLS/DTLS handshakes with digital certificates are used for secure M2M communication, then security is ensured, but data exchange volume increases and device burden increases
Solution Approach 1:
The patent segments the authentication process into two parts: initial full handshake with digital certificates to establish trust, and subsequent resumption handshakes using only session identifiers and symmetric keys. This segmentation allows full security verification initially while minimizing data exchange in subsequent communications.
Solution Approach 2:
The patent performs preliminary authentication using digital certificates during the initial handshake before establishing the secure session. The security credentials are verified upfront, allowing subsequent communications to use lighter-weight resumption protocols without compromising security.
2Reliability
If full TLS/DTLS handshakes are performed for each communication session, then security is maintained, but session establishment time increases
Solution Approach 1:
The patent divides the handshake process into initial full authentication (security-critical) and subsequent resumption (time-critical). The segmentation allows security verification to be performed once initially, while subsequent session resumptions use simplified procedures that minimize time loss.
Solution Approach 2:
The patent creates a simplified copy of the authentication process for session resumption. Instead of repeating the full certificate verification, it uses copied session identifiers and symmetric keys to re-establish secure communication quickly while maintaining security integrity.
3Reliability
If digital certificates are transmitted during handshakes, then secure authentication is achieved, but the complexity of the communication protocol increases
Solution Approach 1:
The patent segments certificate transmission to occur only during the initial handshake, not during session resumption. This reduces protocol complexity for the majority of communications while maintaining authentication security when needed.
Solution Approach 2:
The patent extracts the certificate verification step from the routine session establishment process and isolates it to the initial handshake only. Subsequent sessions extract only the essential session resumption elements (identifiers and symmetric keys), removing unnecessary complexity from frequent operations.
Data Source
AI summary
The present techniques generally describe a computer implemented method for establishing a secure communication session between a client device and a first server, the method performed by the client device comprising: obtaining, from a second server, credential data comprising a session identifier and cryptographic key data; performing a connection handshake with the first server to establish the secure communication session; creating a security state record defining one or more parameters used to establish the secure communication session, and associating the session identifier with the security state record; performing a first resumption handshake with the first server using the session identifier to re-establish the secure communication session.