NFC Tag Key Storage for Verifiable End-to-End Messaging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption methods do not enable verifiable end-to-end encrypted messaging between edge devices without requiring storage of applications or keys on the edge device, and ensure data persisted in the cloud is encrypted and inaccessible to third parties or cloud providers.
Innovation Solution
Utilizing near-field communication (NFC) tags to store encrypted private keys and leveraging a central repository for public keys and group keys, enabling secure end-to-end messaging by generating data encryption keys locally and verifying message integrity through digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored on edge devices to enable end-to-end messaging, then messaging security is improved, but device storage requirements and security risks increase
Solution Approach 1:
The patent extracts the private key storage function from the edge device and relocates it to an NFC tag. The private key is encrypted and stored externally on the NFC tag, while the edge device only retains the encrypted form and decryption capability through NFC communication. This extraction reduces device storage requirements and attack surface while maintaining security.
Solution Approach 2:
The NFC tag serves as an intermediary between the key generation system and the edge device. It securely holds the encrypted private key and enables authenticated access without requiring the key to be permanently stored on the edge device. The NFC interface acts as a controlled mediator that provides just-in-time key access.
2Reliability
If private keys are stored securely outside the device, then security against device compromise is improved, but key access and management complexity increases
Solution Approach 1:
The private key is pre-encrypted with a password-derived key before being written to the NFC tag. This preliminary encryption action ensures that even if the NFC tag is accessed without authorization, the private key remains protected. The encryption is performed in advance during key generation, simplifying subsequent access operations.
Solution Approach 2:
The system performs self-service key management by automatically encrypting the private key with a key derived from user password input. The decryption process automatically occurs when the user provides the correct password through the NFC interface, eliminating the need for manual key management operations.
3Ease of operation
If cloud storage is used for message persistence, then data accessibility is improved, but risk of cloud provider access increases
Solution Approach 1:
The encryption architecture segments the key hierarchy into multiple independent components: the private key stored on NFC tag, the symmetric key for message encryption, and the asymmetric key pair for authentication. This segmentation ensures that cloud storage contains only encrypted data that cannot be accessed without multiple separate secrets, eliminating the single point of failure.
Solution Approach 2:
The system applies preliminary anti-action by encrypting all data with strong cryptography before storage in the cloud. The encryption keys are managed separately through NFC authentication, creating a pre-emptive barrier that prevents cloud providers from accessing stored data even if they have physical or administrative access to the storage infrastructure.
Data Source
AI summary
A computer-implemented method, according to one embodiment, includes using a first symmetric key to encrypt a first private key of a first asymmetric key pair, and storing the encrypted first private key on a predetermined near-field communication (NFC) tag. The method further includes storing a first public key of the first asymmetric key pair and the first symmetric key on a predetermined central repository, and obtaining an encrypted first message and an encrypted first group key from the central repository. The encrypted first message was encrypted using the first group key, and the encrypted first group key is the first group key encrypted using the first public key. The method further includes using the encrypted first private key stored on the predetermined NFC tag to decrypt the encrypted first message.