Secure AEAD Peer-to-Peer Protocol for Reliable Processor Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication protocols between processors on a single PCB or device lack standard solutions for authenticated encrypted reliable point-to-point communication, leaving systems vulnerable to attacks and lacking connection reliability guarantees.
Innovation Solution
A secure peer-to-peer communication protocol using Authenticated Encryption with Associated Data (AEAD) and pre-shared symmetric keys to establish session keys, ensuring confidentiality, integrity, and authenticity, with retransmission mechanisms for reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ad-hoc custom solutions with block ciphers in unauthenticated mode are used, then some encryption protection is provided, but the system becomes vulnerable to attacks due to misapplication of cryptographic primitives and lacks connection reliability guarantees
Solution Approach 1:
The patent transitions from unauthenticated encryption modes to authenticated encryption modes (AEAD), fundamentally changing the cryptographic parameter mode. This ensures that both confidentiality and authentication are provided simultaneously through standardized primitives like AES-GCM, preventing misapplication vulnerabilities while maintaining reliability through built-in authentication mechanisms.
Solution Approach 2:
The patent introduces standardized authenticated encryption primitives as an intermediary layer between the application and the cryptographic operations. By using well-defined standards like AES-GCM with proper nonce management and authentication tags, the system avoids direct misapplication of cryptographic primitives while ensuring both security and reliability.
2Loss of time
If session keys are established quickly after power up, then communication setup time is reduced, but security may be compromised in low-resource environments
Solution Approach 1:
The patent performs preliminary key derivation from pre-shared keys before actual communication begins. By pre-establishing the cryptographic foundation using lightweight key derivation functions suitable for low-resource devices, the system enables rapid session establishment without compromising security, as the heavy cryptographic work is prepared in advance during manufacturing or initial setup.
Solution Approach 2:
The system uses self-contained pre-shared keys stored locally in each device, eliminating the need for complex key exchange protocols during session establishment. Each device independently derives session keys from its pre-shared key using lightweight key derivation, enabling fast secure connection setup without external assistance or heavy computational resources.
3Reliability
If retransmission mechanisms are implemented for reliability, then data transfer reliability is improved, but communication overhead and complexity increase
Solution Approach 1:
The patent combines authentication, encryption, and data integrity verification into a single AEAD cipher operation. This merging eliminates the need for separate MAC computation and verification steps, reducing protocol complexity while maintaining reliability through the integrated authentication tag that automatically detects tampering or transmission errors.
Solution Approach 2:
The authentication tag generated by the AEAD cipher provides immediate feedback on data integrity and authenticity. If transmission errors or tampering occur, the authentication verification fails, triggering automatic retransmission of the affected data unit, thus ensuring reliability through a simple feedback mechanism rather than complex error correction protocols.
Data Source
Figure 1
Figure 2
AI summary
Method for securely transmitting data between first and second processing units, each having stored a SSK and a respective ID, known to the other processing unit. First and second authentication challenge comprising a first and second random numbers are transmitted from the first and second processing units, respectively. A first session key, a second session key, a first authentication key and a second authentication key are generated at each of the processing units, using the first and second authentication challenge and the SSK. First and second authentication response carrying authentication codes are transmitted from the first and second processing units. The first and second processing units verify the other using the authentication response if the received authentication codes match a corresponding authentication code generated locally. If verified, data is then transmitted between the processing units using the session keys employing AEAD encryption.