Secure Channel Initialization Using Shared Secret Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure channel protocols like SSL/TLS require manual initialization steps, such as certificate trust establishment and management, which are costly and labor-intensive, especially when dealing with multiple system components.
Innovation Solution
A method utilizing a low-entropy shared secret distributed during system component installation to establish secure channels without the need for manual certificate management, using Simple Password Exponentiation Key Exchange (SPEKE) to derive high-entropy encryption and MAC keys for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS protocol is used for secure communication between system components, then confidentiality and integrity are improved, but manual certificate trust establishment and management are required which increases device complexity and administrative effort
Solution Approach 1:
The patent applies preliminary action by distributing a shared secret during the initial system component installation phase. This shared secret is stored in a secure element of each component before deployment, enabling automatic mutual authentication without requiring subsequent manual certificate trust establishment. The initialization occurs in advance, eliminating the complexity of ongoing certificate management.
Solution Approach 2:
The patent introduces a shared secret as an intermediary element that mediates authentication between system components. Instead of requiring direct certificate trust relationships between all components, the shared secret acts as a common reference that enables mutual authentication. Each component uses the shared secret to verify the other's identity, simplifying the trust model.
2Reliability
If manual certificate trust establishment is performed for each system component, then secure channel initialization is achieved, but time and labor resources are consumed
Solution Approach 1:
The patent performs the authentication credential setup in advance during system component installation. The shared secret is distributed and stored in secure elements before the components are deployed into the system. This preliminary action eliminates the need for time-consuming manual certificate trust establishment when components need to communicate, reducing initialization time significantly.
Solution Approach 2:
The patent enables components to perform self-service authentication using the pre-distributed shared secret stored in their secure elements. Each component can independently verify the other's identity without requiring external administrator intervention for certificate management. This self-service capability reduces both time and labor resources required for authentication setup.
3Adaptability or versatility
If standard secure channel protocols are used without modification, then compatibility is maintained, but additional manual initialization steps are required
Solution Approach 1:
The patent uses the shared secret as an intermediary that enables standard secure channel protocols to operate without manual initialization. The shared secret is leveraged by SPEKE (Simple Password Exponentiation Key Exchange) to automatically establish mutual authentication and derive session keys, allowing protocols like SSL/TLS to function with their standard workflows while eliminating the need for manual certificate trust establishment.
Solution Approach 2:
The patent changes the authentication parameter from manual certificate trust relationships to an automated key exchange process based on pre-distributed shared secrets. By using SPEKE with the shared secret stored in secure elements, the system transforms the authentication mechanism while maintaining compatibility with standard secure channel protocols, improving ease of operation without sacrificing adaptability.
Data Source
AI summary
Methods and systems for secure channel initialization between a client network element and a server network element are disclosed. In accordance with one embodiment of the present disclosure, the method includes: sending a secure channel initialization request from the client network element to the server network element; receiving the secure channel initialization request at the server network element; creating a server credential and a client credential at the server network element; and sending a secure channel initialization response from the server network element to the client network element, the secure channel initialization response including the server credential and the client credential, wherein said server credential and said client credential are used to establish a secure session.