Secure Communication Channel Establishment Using Cryptographic Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password-based encryption methods for secure communication between computing devices are inadequate due to vulnerabilities such as interception, guessing, and user errors, and they do not integrate well with biometric authentication systems.
Innovation Solution
A method for establishing trusted communication between computing devices using cryptographic elements and device identifiers, where a first computing device sends a request to create a secure channel to a second device, and upon receiving a matching channel identifier and cryptographic element, it derives a secret key for secure message exchange, eliminating the need for password entry and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used for secure communication, then users can authenticate themselves to access services, but passwords can be intercepted, stolen, or guessed without user awareness
Solution Approach 1:
The patent extracts the authentication mechanism from traditional password-based systems and replaces it with public key infrastructure. The server generates a public-private key pair, where the public key is distributed to clients and the private key remains securely on the server. This extraction eliminates the need for passwords that can be intercepted, while maintaining authentication functionality through cryptographic key pairs.
Solution Approach 2:
The patent introduces cryptographic keys as an intermediary between the user and the service authentication system. Instead of directly using passwords for authentication, the system uses public keys as mediators that enable secure verification without exposing sensitive credentials. The public key acts as a safe intermediary that can be freely distributed while the private key securely performs the authentication verification.
2Ease of operation
If password-based authentication is used, then user authentication is achieved, but users are prone to forgetting passwords or entering incorrect passwords resulting in system lockout
Solution Approach 1:
The patent replaces the mechanical password entry system with a cryptographic authentication system. Instead of requiring users to manually remember and type passwords, the system uses public key cryptography where authentication is performed automatically through cryptographic verification. The user's public key serves as their authentication credential, eliminating the need for memory-intensive password management while preventing lockout through cryptographic proof of identity.
3Reliability
If traditional encryption methods are used, then data exchange between devices is protected, but personally identifiable information must be exposed for channel establishment
Solution Approach 1:
The patent extracts personally identifiable information (such as device identifiers and user profiles) from the channel establishment process. Instead of exposing these identifiers during secure channel creation, the system uses public keys that do not contain PII. The public key serves as an anonymous credential that enables secure channel establishment without revealing any personally identifiable information about the user or device.
Solution Approach 2:
The patent employs temporary session keys and ephemeral cryptographic parameters for each secure channel establishment. These short-lived cryptographic objects replace the need for persistent PII-based authentication credentials. Each communication session uses fresh, disposable cryptographic material that is discarded after use, preventing the long-term exposure of personally identifiable information while maintaining secure communication.
Data Source
AI summary
There is presented a method, a computing device and a computing system for establishing secure communication between computing devices. A method for a first computing device to establish trusted communication with a second computing device comprises the first computing device sending a request to create a secure channel to the second computing device, the request comprising a first cryptographic element and a device identifier. The first computing device receives a channel identifier from the second computing device in response to the request, and a notification over a secure channel using the device identifier, the notification comprising a channel identifier and a second cryptographic element. The first computing device compares the channel identifier received in the response to the request and the channel identifier received in the notification and, if the first computing device determines that the two channel identifiers match, the first computing device deriving a secret key using the first cryptographic element and the second cryptographic element.