SA-Indexed SPI Generation for Secure Key Exchange Authentication

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing secure key exchange (SKE) systems generate a Security Parameter Index (SPI) using a random number generator without association with other values, which limits the effectiveness and efficiency of secure data transfer between endpoints in computing environments.

Innovation Solution

Implementing SKE messaging using an SPI Transform that enables additional functions for a given Security Association (SA) between two endpoints, including hardware acceleration and secure data transfer through the use of an SPI Transform Compatibility mode or a Pass Through SPI Transform mode.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If a random number generator is used to generate SPI without association with other values, then the generation process is simple, but the effectiveness and efficiency of secure data transfer is limited

Engineering Contradiction:
Improvesecure data transfer efficiencyVSAvoidSPI generation complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent introduces an SPI Transform mechanism that acts as an intermediary between the SA Index and the final SPI value. Instead of directly using a random number generator, the system applies a transformation function that takes the SA Index and additional random values, combines them through cryptographic operations, and produces an SPI that is both secure and efficiently derived. This intermediary transformation resolves the contradiction by adding computational value without requiring complete redesign of the generation process.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the SPI generation process by changing the parameters involved: instead of relying solely on random number generation, it incorporates the SA Index as a fundamental parameter and applies cryptographic transformation functions. This parameter change enables the SPI to be associated with other values (specifically the SA Index) while maintaining security, thereby improving secure data transfer effectiveness without excessive complexity.

Inventive Principle:
Principle #35Parameter changes

2Adaptability or versatility

If SPI is generated without association with SA Index, then the generation process is independent and simple, but additional functions like hardware acceleration cannot be enabled

Engineering Contradiction:
Improveadditional functions enablementVSAvoidSPI Transform implementation complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements preliminary action by establishing the SPI Transform mechanism in advance, which creates an associative relationship between the SPI and the SA Index before actual data transfer operations. This preliminary transformation enables subsequent functions such as hardware acceleration to be properly configured and enabled, as the SPI now carries meaningful associations that can be utilized by these additional functions without requiring complex runtime modifications.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The SPI Transform mechanism serves multiple functions: it generates the SPI value, associates it with the SA Index, enables hardware acceleration, and supports various encryption algorithms. By making the SPI generation process multi-functional through the transformation mechanism, the system achieves adaptability for additional functions while managing complexity through a unified approach that handles multiple requirements within a single framework.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Reliability

If certificate-based authentication is used between endpoints, then strong secure authentication is provided, but the authentication process requires re-authentication even for trusted nodes

Engineering Contradiction:
Improveauthentication securityVSAvoidauthentication time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-establishing the SPI association with the SA Index during the initial key exchange process. This preliminary configuration creates a trusted relationship that can be leveraged for subsequent operations, allowing the system to maintain strong authentication security while avoiding repeated full authentication cycles for trusted nodes, thereby reducing authentication time.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The SPI Transform mechanism enables self-service by allowing the system to automatically maintain and utilize the associative relationship between SPI and SA Index for trusted nodes. Once the initial authentication and key exchange are completed, the system can self-manage subsequent operations using the pre-established associations, eliminating the need for repeated manual authentication processes while maintaining security through the cryptographic transformations already in place.

Inventive Principle:
Principle #25Self-service

Data Source

PatentUS12425219B2Generating a secure key exchange authentication request using a security parameter index transform
Publication Date: 2025.09.23 INTERNATIONAL BUSINESS MACHINE CORPORATION
  • US12425219B2 patent drawing
  • US12425219B2 patent drawing
  • US12425219B2 patent drawing

AI summary

Embodiments of the present disclosure provide systems and methods for generating a secure key exchange (SKE) Authentication Request using a Security Parameter Index (SPI) Transform to provide secure data transfer in a computing environment. A disclosed method comprises receiving an SKE SA Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and a responder channel on a responder node. The LKM creates an SPI based on an SPI Transform using an SA Index and SPI Transform values, and the LKM builds the SKE Authentication Request message, which comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms supported by the initiator channel. The LKM sends the SKE Authentication Request message to the responder channel on the responder node using the initiator channel.