Publish-Subscribe Server for Secure Industrial Key Disclosure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic solutions for industrial automation and control systems fail to balance the need for secure, encrypted communication with the requirement to monitor and diagnose communication links efficiently, as they either compromise confidentiality or introduce delays and vulnerabilities in key negotiation.
Innovation Solution
A method using a publish-subscribe server to automatically disclose a cryptographic key to a monitoring unit, allowing it to decrypt communication links without explicit integration in key negotiation, enabling flexible monitoring with minimal delay and secure key distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are negotiated during connection setup to encrypt transmitted data, then communication confidentiality is improved, but monitoring capability deteriorates
Solution Approach 1:
The patent introduces a publish-subscribe server as an intermediary component that receives cryptographic keys from communication participants and distributes them to monitoring devices. This mediator enables monitoring capability without compromising the encrypted communication between participants, as the server handles key distribution separately from the actual data transmission.
2Ease of operation
If integrity-only cipher suites are used to protect data integrity, then monitoring capability is improved, but communication confidentiality deteriorates
Solution Approach 1:
The patent implements dynamic key distribution where the same publish-subscribe server infrastructure supports both encrypted communication (when confidentiality is needed) and monitoring (when transparency is needed). The system adapts its behavior based on the communication mode, allowing flexibility to switch between confidentiality and monitoring capabilities as required by different operational scenarios.
3Ease of operation
If multi-context TLS protocol with intermediary components is used, then monitoring capability is improved, but connection establishment time deteriorates
Solution Approach 1:
The patent performs preliminary registration of monitoring devices with the publish-subscribe server before actual communication occurs. This advance setup ensures that when cryptographic keys are negotiated, they are automatically distributed to pre-registered monitoring devices without requiring active participation during the key negotiation process, thus avoiding connection establishment delays.
Solution Approach 2:
The publish-subscribe server automatically handles key distribution to monitoring devices without requiring their active participation in the key negotiation process. The monitoring devices simply subscribe to the appropriate topics, and the server autonomously delivers the cryptographic keys, eliminating the time delay associated with manual or active intermediary participation.
4Ease of operation
If cryptographic keys are manually distributed to monitoring devices, then monitoring capability is improved, but system complexity deteriorates
Solution Approach 1:
The publish-subscribe server serves multiple functions: it acts as an authentication server, a key distribution server, and a message broker simultaneously. This multi-functional approach consolidates what would otherwise require separate systems into a single platform, reducing overall system complexity while enabling comprehensive monitoring capability.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Method for disclosing at least one cryptographic key (CC) used to encrypt at least one communication link (110) between a first communication participant (101) and a second communication participant (103), wherein - in a publish-subscribe server (120) at least one of the communication participants (101, 103) is registered as a publishing entity (P1) and at least one monitoring entity (130, 131) is registered as a subscribing entity (S1), and upon subsequent negotiation of a cryptographic key (CC) by the publishing entity (P1) automatically - the negotiated cryptographic key (CC) is provided by the publishing entity (P1) to the publish-subscribe server (120), - the negotiated cryptographic key (CC) is transmitted by the publish-subscribe server (120) to the at least one subscribing entity (S1),and - the encrypted communication link (110) is decrypted by the subscribing unit (S1) with the cryptographic key (KK), as well as a corresponding system.