Media Key Block Based Device Key Derivation for Secure Network Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional key management systems require distributing encryption keys from a key server to each device, which is inefficient and complicates revocation processes, especially in large-scale networks like smart grids where secure and efficient key sharing and revocation are critical.
Innovation Solution
A system where a key distribution center (KDC) distributes a media key block (MKB) to devices, allowing them to create and share keys among themselves, with the KDC only needing to update the MKB to revoke devices, eliminating the need for individual key distribution and simplifying revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a key server distributes encryption keys to each device individually, then key sharing is achieved, but the system complexity and revocation burden increase significantly
Solution Approach 1:
The patent segments the key management system into two parts: a key distribution center that manages master keys and generates media key blocks, and client devices that independently derive session keys using the media key block and their own device keys. This segmentation reduces the key management burden from the key server by eliminating the need to distribute individual encryption keys to each device.
Solution Approach 2:
The patent introduces a media key block as an intermediary element that facilitates key sharing among multiple devices. The media key block acts as a shared secret that devices combine with their individual device keys to derive session keys, eliminating the need for the key server to manage individual device keys and simplifying the revocation process.
2Reliability
If individual encryption keys are distributed to each device, then secure communication is enabled, but revocation becomes inefficient and time-consuming
Solution Approach 1:
The patent implements preliminary action by having devices pre-share a media key block with the key distribution center before actual communication occurs. This media key block is used to derive session keys dynamically, so when revocation is needed, the system only needs to update the media key block rather than managing individual key revocations for each device, significantly reducing revocation time.
3Ease of operation
If a key server manages all encryption keys centrally, then key distribution is simplified, but the burden on the key server increases with network scale
Solution Approach 1:
The patent implements self-service by enabling client devices to autonomously derive session keys using the media key block and their device keys without requiring the key server to intervene in each key derivation process. This reduces the computational burden on the key server while maintaining secure key distribution, allowing the system to scale efficiently with network size.
Data Source
AI summary
According to one embodiment, an information processing apparatus, which is connected to an external apparatus, includes a device key storage unit, a creating unit, a calculating unit, a communication unit, and a key calculating unit. The device key storage unit stores therein a device key. The creating unit creates a media key from the device key and a media key block. The calculating unit calculates first output information on the basis of first inherent information inherent to the information processing apparatus and public information. The communication unit transmits the first output information to the external apparatus and receives second output information calculated by the external apparatus from the external apparatus. The key calculating unit calculates a shared key shared between the information processing apparatus and the external apparatus on the basis of the media key, the first inherent information, and the second output information.