Remote Server PKI Key Management for Mobile Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face challenges in implementing secure key storage and management, especially when highly secure storage in the terminal device, such as a subscriber identity module, is not possible, leading to unprotected private keys and difficulties in key exchange.
Innovation Solution
A communication system that stores the private key in a remote server system, allowing the public key to be stored with the communication partner, and uses this server to encrypt and decrypt session keys for secure transmission to the terminal device, providing an external secure storage environment and facilitating key exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored directly on the end device, then key access is simple and fast, but security protection is insufficient compared to subscriber identity module storage
Solution Approach 1:
A server system acts as an intermediary between the end device and communication partners for key management. The server stores private keys securely and handles key exchange operations, while the end device only needs to store public keys and communicate through the server. This mediator approach provides security comparable to subscriber identity module storage without requiring complex local key management infrastructure in the end device.
2Reliability
If session keys are frequently replaced in the end device, then security is improved, but key management complexity increases significantly
Solution Approach 1:
The server system serves as a mediator that manages session key generation and distribution. When session keys need to be replaced for security reasons, the server can generate new keys and distribute them to communication partners without requiring complex updates to the end device. This maintains high security through frequent key rotation while keeping the end device operationally simple.
3Reliability
If private keys are stored in a secure environment on the server, then security is improved, but key exchange complexity increases
Solution Approach 1:
The server system acts as a trusted intermediary that simplifies the key exchange process. Instead of requiring direct secure communication channels between end devices, the server stores private keys securely and facilitates key exchange by having communication partners send encrypted session keys to the server, which then distributes them to the appropriate end device. This maintains secure storage while simplifying the overall exchange process.
4Adaptability or versatility
If public key infrastructure is implemented without secure storage, then deployment flexibility is improved, but private key protection is weakened
Solution Approach 1:
The server system serves as a protective intermediary that enables PKI implementation without requiring secure storage in the end device. The server maintains secure storage of private keys while allowing flexible deployment across various end devices. Communication partners encrypt session keys with the server-managed public keys, and the server securely distributes them, providing both deployment flexibility and key protection.
Data Source
Figure 1
AI summary
The invention provides a communication system comprising a mobile terminal and a communication partner (some other electronic communication device). A PKI key pair comprising a private key and a public key is set up for the terminal. The public key is stored at the communication partner. The communication partner is designed to provide a session key, to encrypt data using the session key, to encrypt the session key using the public key and to communicate the encrypted data to the terminal. The communication system is distinguished by the fact that it furthermore comprises a server system which is remote from the mobile terminal and in which the private key is stored in a secure environment. In this case, the communication partner is furthermore designed to communicate the encrypted session key to the server system. In addition, the server system is designed to decrypt the session key for the terminal using the private key and to communicate it in decrypted form for encryption of the data to the terminal.