Secure Key Replacement Protocol for PKI Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Public Key Infrastructure (PKI) systems face challenges in securely modifying or removing access privileges, particularly in cryptographic file systems, as current methods lack verification of key caching and lead to complexity or high costs.
Innovation Solution
The Secure Key Replacement Protocol (SKRP) involves receiving a rekey request, authenticating it, replacing the identified private key with a SKRP key, signing a challenge, and returning the signed challenge, ensuring secure and efficient replacement of private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire cryptographic file system is re-encrypted when access rights change, then security is improved, but cost and time consumption increase significantly
Solution Approach 1:
The patent segments the key management process by introducing a dedicated key replacement mechanism that operates independently from the file encryption process. Instead of re-encrypting the entire file system, the system replaces only the file encryption key while maintaining the cryptographic file system structure intact, thus reducing time consumption while preserving security.
Solution Approach 2:
The patent introduces a key replacement protocol that acts as an intermediary between the access control mechanism and the file encryption mechanism. This protocol enables secure key replacement without requiring full re-encryption, serving as a mediator that resolves the contradiction between security maintenance and time efficiency.
2Adaptability or versatility
If the key-pair is changed for the cryptographic file-set, then access control is improved, but security verification is compromised due to key caching
Solution Approach 1:
The patent implements a feedback mechanism through the key replacement protocol that verifies the replacement process completion. The system receives confirmation that the new key has been properly installed and that old keys have been removed, providing feedback that ensures security verification while maintaining access control flexibility.
Solution Approach 2:
The patent performs preliminary actions by establishing a secure channel and authentication mechanism before key replacement occurs. This preliminary setup ensures that only authorized key replacement operations are executed, preventing security verification failures while enabling adaptable access control changes.
3Reliability
If multiple encryption keys are used for previously stored information, then access protection is improved, but system complexity increases
Solution Approach 1:
The patent applies the discarding and recovering principle by securely deleting old encryption keys after successful replacement and recovering the ability to access files through the new key. This process maintains access protection by ensuring only current keys can decrypt files while reducing system complexity by removing obsolete keys from the system.
Data Source
AI summary
A method, and a corresponding apparatus, provide for remote, secure replacement of private keys in a private key infrastructure. The method is implemented as a secure key replacement protocol (SKRP), which includes the steps of receiving a rekey request, where the rekey request identifies a private key for replacement, authenticating the rekey request, replacing the identified private key with a SKRP key, signing the challenge with the SKRP key, and returning the signed challenge. The rekey request includes the SKRP key and the challenge.