Secure Box Mediator for End-to-End Encrypted Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing systems face challenges in establishing secure, end-to-end encrypted communication between remote terminal apparatus and server apparatus, as intermediate relay servers often terminate encryption protocols, preventing secure data transmission.
Innovation Solution
The system employs a secure box that executes a regular TLS handshake with the server apparatus and exchanges TLS handshake information between the terminal apparatus and the secure box, allowing the terminal apparatus to generate and use a common key for encrypted communication, while ensuring the relay server cannot intercept or generate the key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an intermediate relay server is used to enable remote connection, then connectivity between terminal apparatus and server apparatus is improved, but security of encrypted communication deteriorates because the relay server terminates encryption protocols
Solution Approach 1:
The patent introduces a secure box as an intermediary device that performs TLS handshake with both the terminal apparatus and the server apparatus, acting as a mediator that maintains encrypted communication paths. The secure box receives TLS handshake information from the terminal apparatus and forwards it to the server apparatus, enabling remote connectivity while preserving end-to-end encryption security by not terminating the encryption protocols itself.
2Device complexity
If the relay server terminates encryption protocol, then data transmission through the relay is simplified, but the common key becomes vulnerable to interception by the relay server
Solution Approach 1:
The patent extracts the encryption termination function from the relay server and relocates it to the secure box. By taking out the TLS handshake processing from the untrusted relay server environment and performing it within the trusted secure box, the system simplifies data transmission through the relay while preventing key interception, as the common key is generated and stored only in the secure box and terminal apparatus, never passing through the relay server.
3Reliability
If TLS handshake information is exchanged between terminal apparatus and secure box, then end-to-end encrypted communication is enabled, but communication protocol complexity increases
Solution Approach 1:
The patent segments the TLS handshake process into distinct phases: the terminal apparatus performs TLS handshake with the secure box to obtain the common key, while the secure box separately performs TLS handshake with the server apparatus. This segmentation allows end-to-end encryption to be established between terminal and server without requiring them to directly negotiate complex protocols, as the secure box handles the protocol complexity in isolated handshake segments.
Data Source
AI summary
An information processing apparatus includes circuitry that detects reception of first data from a connection source apparatus. The first data includes information about establishment of a session for encrypted communication between the source apparatus using a service and a connection destination apparatus providing the service. The circuitry converts the first data into a first message following a communication protocol in the session establishment, and converts a second message from the destination apparatus into second data including at least information for generating a common key for the encrypted communication. Before the session establishment, the circuitry transmits the first message to the destination apparatus and transmits the second data to the source apparatus. After the session establishment, the circuitry transmits service data from the source apparatus to the destination apparatus and from the destination apparatus to the source apparatus in an unconverted state. The service data is used in the service.