Multicast Encryption Key Distribution via Segmented Root Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Digital message broker systems lack effective authentication and authorization mechanisms, particularly neglecting fast anti-forgery to prevent legitimate recipients from forging new messages to the rest of the group, and existing security measures fail to provide efficient encryption and key distribution.
Innovation Solution
A method for fast encryption and authentication of messages using a root key encrypted with a root session management key, which is then encrypted with recipient public keys to create device session management keys, allowing only intended recipients to decrypt messages, with additional recipients easily added without re-keying existing recipients, using pseudorandom numbers and initialization vectors for secure key generation and distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional message distribution systems are used, then message delivery is efficient, but authentication and authorization on a consumer-by-consumer basis is lacking
Solution Approach 1:
The patent segments the security mechanism into multiple components: root key, device session management keys (DSMK), message session keys, and authentication tags. Each component serves a specific function in the authentication and encryption process, allowing for fine-grained control over message distribution security without requiring complete re-keying when adding new recipients.
Solution Approach 2:
The patent performs preliminary key establishment by generating device session management keys (DSMK) for each recipient in advance using their public keys and the root key. These DSMKs are distributed to recipients before actual message exchange, enabling fast authentication and encryption during message transmission without requiring complex real-time key agreement protocols.
2Reliability
If security mechanisms are added to message broker systems, then authentication is improved, but fast anti-forgery capability is neglected
Solution Approach 1:
The patent performs preliminary authentication by generating authentication tags for messages before transmission. The sender computes an authentication tag based on the message content, session key, and recipient identity in advance. This allows recipients to quickly verify message authenticity without requiring complex real-time authentication protocols, achieving both fast anti-forgery capability and high message processing speed.
Solution Approach 2:
The patent introduces session keys as an intermediary between the root key and actual message content. The session keys are derived from the root key and recipient-specific DSMKs, enabling efficient symmetric encryption and authentication for multiple recipients without requiring each recipient to have direct access to the root key or requiring asymmetric encryption for every message.
3Reliability
If encryption is applied to all messages, then security is improved, but key distribution becomes complex when adding new recipients
Solution Approach 1:
The patent segments the key distribution process into two phases: initial DSMK distribution and ongoing message encryption. The root key is used to generate recipient-specific DSMKs that are distributed once per recipient. After this initial setup, all messages to that recipient can be encrypted efficiently using symmetric encryption with session keys derived from the pre-distributed DSMK, avoiding the need to redistribute keys whenever new messages are sent.
Solution Approach 2:
The patent performs preliminary key establishment by generating and distributing device session management keys (DSMK) for each recipient before actual message exchange. These DSMKs are derived using the recipient's public key and the root key, enabling fast symmetric encryption during message transmission without requiring complex real-time key agreement protocols.
4Reliability
If asymmetric cryptography is used for all communications, then security is improved, but processing speed decreases
Solution Approach 1:
The patent segments the cryptographic operations into asymmetric and symmetric phases. Asymmetric cryptography (using public-private key pairs) is used only for initial key establishment to generate device session management keys (DSMK). Once DSMKs are established, all subsequent message encryption and authentication uses fast symmetric cryptography with session keys derived from the pre-shared DSMKs, achieving both high security and fast processing throughput.
Solution Approach 2:
The patent introduces session keys as an intermediary between the root key and actual message content. The session keys are derived from the root key and recipient-specific DSMKs, enabling efficient symmetric encryption and authentication for multiple recipients without requiring each recipient to have direct access to the root key or requiring asymmetric encryption for every message.
Data Source
AI summary
To prevent legitimate message recipients from forging new messages and to encrypt messages for a specific set of recipients (channel), a root key is encrypted and combined with a base session management key to render a combined root key, which in turn is encrypted with a public key of at least one recipient device to render a session management key. The public key of each of “N” intended recipient device encrypts the combined root key to render “N” session management keys. The session management keys are then combined with the combined root key to render a multicast root key, which is signed with a private key of a sending device. The signed multicast root key is combined with the session management keys to render an encrypted, signed multicast root key that is used to encrypt digital information prior to transmitting the digital information.