Pairwise Pre-Shared Key Generation for Mesh Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN network security methods, such as pre-shared keys and certificate authorities, face challenges in managing unique keys across network elements, leading to issues like revocation difficulties and potential identity spoofing, especially in mesh networks where N*(N−1)/2 keys are required, and users often prefer simpler solutions.
Innovation Solution
Implementing Blom's Symmetric Key Generation System (KGS) with a centralized key management system and key server, where each network element registers to receive a key seed and identifier, allowing on-demand generation of shared keys based on public identifiers, using IKEv2 exchanges and NHRP for secure key distribution and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-shared keys are configured across all network nodes in a mesh network, then security between any two nodes is ensured, but the number of keys to be provisioned increases to N*(N−1)/2, making key management complex
Solution Approach 1:
A key server is introduced as an intermediary component that centralizes key management functions. The key server generates and distributes pre-shared keys to network nodes on demand, eliminating the need for manual configuration of N*(N-1)/2 keys. This mediator approach maintains security while dramatically reducing management complexity.
Solution Approach 2:
Network nodes are equipped with capabilities to autonomously request and obtain pre-shared keys from the key server when needed. Instead of requiring administrators to manually provision all keys, the system enables automated self-service key acquisition, reducing operational overhead.
2Ease of operation
If group keys are used for all VPN gateways to authenticate each other, then configuration is simplified, but revocation of a VPN gateway becomes nearly impossible and identity spoofing is enabled
Solution Approach 1:
The key server acts as a trusted intermediary that issues unique pre-shared keys to each VPN gateway. This enables individualized authentication where each gateway has its own credentials, allowing selective revocation by simply stopping key issuance to the compromised gateway while leaving others unaffected.
Solution Approach 2:
Instead of using a single group key for all gateways, the system segments authentication credentials by issuing unique pre-shared keys to each individual gateway. This segmentation enables granular control over authentication, where each gateway's security can be independently managed and revoked without affecting the entire group.
3Reliability
If a certificate authority and digital certificates are used to secure network nodes, then authentication security is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The system uses simple pre-shared keys as disposable authentication credentials instead of complex digital certificates. These keys can be easily generated, distributed, and revoked by the key server without requiring certificate authorities, certificate validation infrastructure, or complex trust chain management.
Solution Approach 2:
The patent replaces the mechanical certificate authority system with a simpler key server-based approach. Instead of using public key infrastructure, certificate signing, and validation mechanisms, the system substitutes a centralized key distribution mechanism that achieves similar security goals with reduced complexity.
Data Source
AI summary
A Key Generation System (KGS) includes a key server, a first network element, and a second network element. The first and second network elements register with the key server and receive first and second KGS key seeds and first and second KGS identifiers, respectively. The first network element transmits the first KGS identifier to the second network element and obtains the second KGS identifier. The first network element computes a shared key based on the first KGS key seed and the second KGS identifier. The second network element receives the first KGS identifier from the first network element and computes the shared key based on the second KGS key seed and the first KGS identifier.