Pairwise Key Establishment Across Changing Measurement States
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices face challenges in deriving common cryptographic keys when multiple entities require access to the same data, as their cryptographic keys are based on differing data items, preventing them from generating a shared key.
Innovation Solution
A method for pairwise key establishment involves storing trusted and expected measurement values in secure storage locations and using a key derivation function to generate a common cryptographic key, ensuring the same inputs are used across different measurement states or entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are derived based on data items that differ between entities, then each entity can maintain its own security state, but multiple entities cannot derive common cryptographic keys to access shared data
Solution Approach 1:
The patent segments the key derivation process into two distinct phases: a first key derivation executed by a first entity using its trusted measurement value, and a second key derivation executed by a second entity using its trusted measurement value. Each entity maintains its own security state through separate key derivation, yet both derive the same cryptographic key because the second entity uses the first entity's trusted measurement value as input to its key derivation function, ensuring key consistency across entities while preserving individual security integrity
Solution Approach 2:
The patent introduces an intermediary mechanism where the first entity's trusted measurement value serves as a shared reference point for the second entity's key derivation. This intermediary value allows the second entity to derive the same cryptographic key without directly accessing the first entity's security state, enabling key sharing while maintaining security boundaries between entities
2Ease of operation
If entities use different measurement states for key derivation, then each entity operates independently, but they cannot derive the same cryptographic key for data access
Solution Approach 1:
The patent applies preliminary action by having the first entity execute its key derivation and store its trusted measurement value before the second entity performs its key derivation. The second entity then uses this pre-stored trusted measurement value as input to its key derivation function, ensuring that both entities derive the same cryptographic key while maintaining their independent operation sequences
Data Source
AI summary
Systems and techniques are described for key establishment. For instance, a process can, during a first cryptographic key derivation, store a first trusted measurement value of a first entity in a first storage location, store an expected measurement value of a second entity in a second storage location, and generate a first instance of a cryptographic key using the first trusted measurement value, the expected measurement value, and a key derivation function (KDF). The process can, during a second cryptographic key derivation, obtain the expected measurement value as a second trusted measurement value of the second entity and store it in the second storage location, obtain the first trusted measurement value as a second expected measurement value and store it in the first storage location, and generate a second instance of the cryptographic key using the second expected measurement value, the second trusted measurement value, and the key derivation function.