Onion Layer Encryption for Magnetic Strip Card Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Magnetic strip cards used in access control systems face security risks due to the limited storage space, which cannot accommodate multiple encryption keys for multiple locks, and using a single encryption key across all locks compromises security if one lock is compromised.
Innovation Solution
Implementing an onion-layer encryption method where a card payload is encrypted with a short key specific to each access control and further encrypted with a Long Term Shared Key, allowing multiple code keys for different locks while minimizing storage overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different encryption keys are used for each lock, then security is improved, but the card storage space is insufficient to store multiple encrypted copies
Solution Approach 1:
The patent implements nested encryption by placing the lock-specific short key encryption inside the long-term shared key encryption. The card payload contains code keys encrypted with individual lock short keys, which are then encrypted with the long-term shared key. This nested structure allows multiple lock-specific keys to be stored in the limited card space while maintaining security isolation between locks.
Solution Approach 2:
The encryption system is segmented into two distinct layers: a long-term shared key for overall card protection and short-term lock-specific keys for individual lock access. This segmentation allows the card to store multiple lock-specific encrypted copies without requiring full storage of all possible key combinations, as each lock only needs its specific short key portion.
2Adaptability or versatility
If the same encryption key is used throughout the hotel, then one card can open multiple locks, but security is compromised as one lock's compromise results in all being compromised
Solution Approach 1:
The single encryption key system is segmented into a long-term shared key (for card-wide protection) and multiple short-term lock-specific keys. This allows one card to access multiple locks (versatility) while maintaining security isolation, as each lock's code key is encrypted with its unique short key that is nested within the long-term shared key encryption.
Solution Approach 2:
The encryption structure nests lock-specific short keys within the long-term shared key encryption. When a card is presented to a lock, the long-term shared key decrypts first to reveal the lock-specific short key, which then decrypts the code key. This nested structure enables multi-lock access while preventing compromise propagation between locks.
3Ease of manufacture
If magnetic strip cards are used instead of smart cards, then cost is reduced, but storage space is limited
Solution Approach 1:
The nested encryption structure allows multiple lock-specific encrypted copies to be stored within the limited capacity of magnetic strip cards. By nesting the lock-specific short key encryption inside the long-term shared key encryption, the system maximizes the use of available storage space on inexpensive magnetic strip cards.
Solution Approach 2:
The patent changes the encryption parameter structure from storing complete independent encryption keys to storing nested encrypted portions. Each lock-specific code key is encrypted with a short key (24 bits) rather than a full key, and these short-key-encrypted portions are then encrypted with the long-term shared key, optimizing storage utilization on low-capacity magnetic strip cards.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A magnetic strip card (12) includes a partial encrypted card payload encrypted with a long term shared key (LK) to provide a final encrypted payload. A method for encoding the magnetic strip card includes encrypting a card payload, the card payload comprising a code key (32a; 32b) of an access control (16; 16a; 16b) with a short key (SKI; SK2) of the access control to generate a partial encrypted payload and encrypting the partial encrypted payload with a long term shared key (LK) to provide a final encrypted payload.