Mutual Key Management Service for TLS Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic protocols like TLS face challenges in key management and authorization, particularly for enterprises with limited computational or financial resources, making it difficult to implement cryptographic improvements without modifying existing applications.
Innovation Solution
A mutual key management service system that provides authorized cryptographic key management by using certificates and MGroup rules to establish mutually authenticated TLS sessions, enabling multi-dimensional authorization and rotation of cryptographic keys, suitable for various computational devices including IoT devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic improvements including authentication are implemented in existing applications, then security is improved, but computational and financial resources are exceeded and applications require refactoring
Solution Approach 1:
The patent introduces a Mutual Key Management Service (MKMS) as an intermediary component that handles cryptographic key management and mutual authentication. The MKMS acts as a mediator between applications and the cryptographic protocol, providing authentication and authorization services without requiring applications to be modified. This resolves the contradiction by externalizing the complex cryptographic functionality to a dedicated service that can be implemented once and reused across multiple applications.
Solution Approach 2:
The patent segments the cryptographic functionality into separate, modular components: the MKMS service handles key management and mutual authentication, while applications focus on their core functionality. The TLS library is separated into a standalone component that interfaces with the MKMS. This segmentation allows cryptographic improvements to be implemented in the MKMS without requiring refactoring of existing applications, thus improving security without increasing application complexity.
2Reliability
If cryptographic improvements are implemented, then authentication and authorization are improved, but existing applications require modification which is not feasible
Solution Approach 1:
The MKMS is designed as a universal service that can provide mutual authentication and key management for multiple different applications without requiring application-specific modifications. The MKMS implements a standardized interface that works with various cryptographic protocols (TLS, IPSec, SSH) and can serve diverse applications including mobile devices and IoT devices. This universality makes implementation feasible across an enterprise's application portfolio without requiring individual application refactoring.
3Reliability
If mutual authentication with rotating cryptographic keys is implemented, then cryptographic hygiene is improved, but computational resources are increased
Solution Approach 1:
The patent implements rotating cryptographic keys through the MKMS, which manages key generation and distribution. The key rotation is implemented at the service level rather than requiring full cryptographic protocol re-execution in each application. The MKMS provides keys in sequences, allowing applications to use rotated keys without repeating the entire authentication handshake. This partial implementation of key rotation (at the key management layer rather than protocol layer) improves cryptographic hygiene while minimizing additional computational overhead.
Data Source
AI summary
A method includes requesting, by a first computing device having a first application and a first transport layer security (TLS) library, a sequence of cryptographic keys from a first mutual key management service (MKMS), the sequence of cryptographic keys based on an MKMS key, requesting, by a second computing device having a second application and a second TLS library, the sequence of cryptographic keys from a second MKMS, performing, by the first MKMS having a first certificate and the second MKMS having a second certificate, an authorization, comparing, by one of the first MKMS and the second MKMS, a second MGroup identifier with a first MGroup rule, and the first MKMS and the second MKMS creating the sequence of cryptographic keys based on the MKMS key.