Secure Element Pairing Key Provisioning for Asymmetric Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing secure connections between wireless devices is challenging due to vulnerabilities in current security methods, particularly in asymmetric device configurations where personal user devices and application devices have differing hardware and software capabilities, necessitating a solution that balances usability and security.
Innovation Solution
A system comprising a first device with a secure element and a cloud architecture that generates a pairing key using a device secret, allowing mutual authentication and secure connection provisioning between devices through a TLS handshake, utilizing symmetric key encryption to reduce memory and computational burdens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key encryption and certificate-based authentication are used to ensure security, then security strength is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent segments the authentication system into two parts: a strong asymmetric authentication phase (TLS handshake with certificates) and a subsequent symmetric encryption phase (AES-GCM). This segmentation allows the resource-intensive asymmetric operations to be limited to initial connection establishment, while bulk data transmission uses efficient symmetric encryption, thereby reducing overall device complexity and resource consumption while maintaining security strength.
Solution Approach 2:
The patent changes the encryption parameter from asymmetric (public-private key pairs) to symmetric (shared session keys) after the initial handshake. This parameter change reduces computational burden and memory requirements for subsequent communications, as symmetric encryption algorithms require significantly fewer resources than asymmetric algorithms, thus resolving the contradiction between security strength and device complexity.
2Reliability
If certificate-based authentication is implemented, then authentication reliability is improved, but memory usage and processing time increase
Solution Approach 1:
The patent implements preliminary asymmetric authentication through the TLS handshake phase, where certificates are verified and mutual authentication is established before any data transmission. This preliminary action ensures authentication reliability is achieved upfront, allowing subsequent communications to use resource-efficient symmetric encryption without repeated certificate verification, thereby reducing overall processing time and energy consumption.
3Productivity
If symmetric key encryption is used for all communications, then processing efficiency is improved, but initial authentication security is weakened
Solution Approach 1:
The patent performs preliminary asymmetric authentication using TLS certificates and mutual authentication mechanisms before establishing symmetric encryption for data transmission. This ensures that the initial authentication phase maintains high security standards while the subsequent symmetric encryption phase achieves processing efficiency, effectively resolving the contradiction between the two requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems related to provisioning a secure connection are disclosed. One disclosed method includes storing a device secret on a secure element in a first device, storing a mapping from the device secret to a device identifier of the first device on a cloud architecture, generating a pairing key using a first connection protocol key generator on the secure element and the device secret, and generating the pairing key using a second connection protocol key generator on the cloud architecture and the device secret. The method also includes transmitting the pairing key from the cloud architecture to a second device in response to receiving the device identifier, mutually authenticating the first and second device using the pairing key, and adding the secure connection to the inter-device connection using the pairing key as stored on the first device and as stored on the second device.