Satellite Session Encryption Using Hardware Cryptoprocessors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing commercial satellite communication (Comsatcom) systems lack sufficient security measures, particularly over-the-air encryption, which is necessary for governmental applications, and existing encryption methods like VPNs significantly impact performance and latency.
Innovation Solution
Implementing a method using a hardware-based cryptoprocessor to generate cryptographic key pairs and encrypt data via a secure processing environment, employing QUIC sessions and hardware-based encryption to ensure secure and efficient data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN encryption is implemented in commercial satellite communication, then security is improved, but latency increases significantly
Solution Approach 1:
The patent extracts the cryptographic operations from the main data transmission path and performs them in a separate secure processing environment. The hardware-based cryptoprocessor handles key generation and encryption/decryption operations independently, allowing data to flow through the satellite link without being bottlenecked by software-based VPN encryption processes, thus reducing latency while maintaining security.
Solution Approach 2:
The system performs preliminary actions by pre-establishing secure transport-layer sessions and pre-generating cryptographic key pairs in the hardware cryptoprocessor before data transmission begins. This allows the encryption infrastructure to be ready in advance, eliminating the need for real-time key generation and setup during data flow, thereby reducing latency.
2Reliability
If hardware-based cryptoprocessor is used for encryption, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a secure processing environment as an intermediary layer between the hardware-based cryptoprocessor and the transport-layer session. This intermediary manages the complex interactions, key handling, and encryption operations, shielding the main system from the complexity of cryptographic operations while the hardware cryptoprocessor provides the security functionality.
3Productivity
If QUIC sessions are used instead of TCP, then throughput is improved, but compatibility with existing systems decreases
Solution Approach 1:
The secure processing environment acts as an intermediary that handles QUIC protocol operations, managing the translation and interaction with existing TCP-based systems. This allows the system to leverage QUIC's performance benefits for satellite communication while maintaining compatibility with legacy systems through the intermediary layer.
Data Source
AI summary
A method of providing encrypted communications for transmission via satellite including providing a transport-layer session with a secure server via satellite; generating a cryptographic session public-private key pair using a hardware-based cryptoprocessor; transmitting a message including the public session key to the secure server via the transport-layer session; receiving a response from the secure server, the response comprising a public key; computing, at the hardware-based cryptoprocessor, a shared key using the received public key and the generated private key; encrypting payload data using the shared key; and transmitting the encrypted payload data to the secure server.