Operator-Assisted Key Establishment for M2M Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data transfer methods in cellular networks, particularly for machine-to-machine (M2M) communication, face challenges such as high overhead in establishing cryptographic keys and security concerns where network nodes have access to unencrypted data meant for servers, leading to inefficiencies and security vulnerabilities.
Innovation Solution
A method and system where a terminal derives a cryptographic key using both a key shared with the network and a key shared with the server, allowing for secure encryption and integrity protection of data transferred over the network, ensuring that the network node does not have access to the encryption key, thus maintaining data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an end-to-end secure tunnel (e.g., IPSec) is established between the terminal and the server, then data security is improved, but significant overhead is introduced in establishing cryptographic keys and maintaining the tunnel
Solution Approach 1:
The patent segments the key establishment process into two parts: a first key shared between terminal and network, and a second key shared between terminal and server. The cryptographic session key is derived by combining these two keys, allowing the network to assist in key establishment without having access to the final session key or the second key, thus reducing overhead while maintaining security
Solution Approach 2:
The network acts as an intermediary that assists in key establishment by providing the first key to the terminal, which then combines it with the second key to derive the session key. This intermediary approach allows the network to facilitate secure communication without compromising security or requiring full tunnel establishment
2Reliability
If a secure tunnel uses a new session key every time the terminal wants to send data, then data security is maintained, but long delay occurs before data can be sent
Solution Approach 1:
The patent establishes the cryptographic session key in advance through the key derivation process using the first and second keys, so that when the terminal needs to send data, the key is already available. This preliminary key establishment eliminates the delay that would occur if a new key had to be generated and exchanged for each data transmission
3Ease of operation
If the network node has access to unencrypted data for authentication purposes, then network control is improved, but security mechanisms are violated that should prevent network node access to server-bound data
Solution Approach 1:
The patent applies different security properties to different parts of the system: the network node has access to the first key for authentication and control purposes, while the second key and derived session key remain exclusive to the terminal and server. This local differentiation allows the network to maintain operational control while ensuring that sensitive data remains secure from network access
Data Source
AI summary
The invention relates to a method and system for key distribution and encryption/decryption. An encryption key (Kenc) is derived in a terminal. The encryption key is applied by the terminal for encrypting at least a part of data included in an application message for an application server transmitted over a network. The terminal and the network both have access to a first key (K1). The terminal and the server both have access to a second key (K2). The encryption key is derived at the terminal using the first key and the second key. The first key or the derivative thereof is received at the server. The encryption key for decrypting the application message encrypted by the terminal is derived in the server using the shared second key and the received first key of the derivative thereof.