Privacy-Enhanced Access Delegation via Derived Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic locks with delegation capabilities do not adequately protect the privacy of the delegatee, as they may expose their identity during access right delegation, leading to potential tracking.
Innovation Solution
Implementing a privacy-enhanced delegation method using derived public and secret keys based on elliptic-curve cryptography, where a derivation scalar is used to generate a temporary key pair for the delegatee, ensuring the physical lock cannot identify or track the delegatee across sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the delegatee uses their true public key for authentication, then the lock can verify the delegation authenticity, but the delegatee's identity is exposed and they can be tracked
Solution Approach 1:
The patent introduces a derived public key as an intermediary between the delegatee's true identity and the lock system. This derived key serves as a mediator that allows authentication without revealing the delegatee's actual identity, thus protecting privacy while maintaining verification reliability
Solution Approach 2:
The patent extracts the identifying information from the authentication process by using only a derived public key (which does not contain identifiable information) instead of the true public key. This separation allows the lock to verify authentication without accessing or storing the delegatee's true identity
2Reliability
If the lock stores the delegatee's public key for future verification, then authentication can be verified across sessions, but the delegatee can be identified and tracked across multiple accesses
Solution Approach 1:
The patent employs derived public keys that are effectively disposable and session-specific. Each delegation creates a new derived key that can be used for authentication but cannot be used to identify the delegatee in future sessions, making the authentication credential short-lived and non-traceable
Solution Approach 2:
The patent segments the authentication process by separating the identity verification function from the authentication function. The lock verifies the derived public key for authentication purposes without needing to store or associate it with the delegatee's true identity, thus preventing tracking while maintaining verification capability
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
It is provided a method for providing a privacy-enhanced delegated access right to unlock a physical lock. The method comprises: obtaining a derivation scalar; receiving a cryptographically signed delegation from the delegator device, the delegation being a data object comprising a public key of the delegator device, a public key of the physical lock, and a derived public key for the delegatee device, and wherein the delegation is cryptographically signed using a secret key that is paired with the public key of the delegator device; obtaining a source secret key for the delegatee device, the source secret key being paired with the source public key; calculating a derived secret key for the delegatee device using the source secret key for the delegatee device and the derivation scalar; providing the delegation to the physical lock; and authenticating the delegatee device with the physical lock using the derived secret key.