Secure Reader Controller Key Exchange ECC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing server/client security protocols require significant computing power, which is not available on access control readers or IoT hubs, leading to inefficiencies in key negotiation, authentication, and security updates, and are vulnerable to 'man-in-the-middle' attacks due to limitations in certificate structures and computing resources.
Innovation Solution
A method for secure communication between a reader and a controller that involves exchanging public keys, generating session keys, and confirming them using a first session key, with the ability to adjust computing power needs and include the reader's serial number in certificates, using a Diffie-Hellman key exchange based on elliptic curves, and optimizing key exchange phases to reduce processing complexity and prevent spying.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS protocol is used for authentication and secure communication, then security level is improved, but computing power requirement increases beyond what access control readers and IoT hubs can provide
Solution Approach 1:
The patent changes the cryptographic parameters by using elliptic curve cryptography (ECC) instead of traditional RSA cryptography. ECC provides equivalent security with smaller key sizes and lower computational requirements, making it suitable for resource-constrained devices like access control readers and IoT hubs while maintaining high security standards.
Solution Approach 2:
The patent segments the authentication and key exchange process into distinct phases: initial authentication phase using pre-shared keys, and subsequent secure communication phase using session keys derived through Diffie-Hellman key exchange. This segmentation allows the heavy cryptographic operations to be performed only during initial setup, while ongoing communications use lighter operations.
2Reliability
If traditional certificate-based authentication is used, then security is improved, but device complexity and key management overhead increase for multiple readers
Solution Approach 1:
The patent implements a universal authentication mechanism where a single pre-shared key can be used across multiple readers and controllers. This multi-functional approach eliminates the need for individual certificate pairs for each device, simplifying key management while maintaining security through the use of device-specific identifiers (serial numbers) incorporated into the authentication process.
Solution Approach 2:
Instead of distributing unique certificates to each reader, the system uses a master controller that holds the authority to generate and distribute session keys to multiple readers. This copying approach allows efficient key distribution where the controller can derive session keys for multiple readers from a single master key pair, reducing the overall key management complexity.
3Reliability
If session keys are updated regularly to prevent brute force attacks, then security is improved, but processing complexity and communication overhead increase
Solution Approach 1:
The patent implements periodic session key updates based on time-based mechanisms. Session keys are automatically renewed after predetermined time intervals or after a certain number of authentication events, providing regular security refreshes without requiring continuous complex key negotiation. This periodic action balances security requirements with operational efficiency.
Solution Approach 2:
The system incorporates feedback mechanisms where the controller monitors authentication attempts and system state, automatically triggering session key updates when security thresholds are reached or when suspicious activity is detected. This feedback-driven approach optimizes the balance between security and processing overhead by updating keys only when necessary.
4Adaptability or versatility
If current certificate structures are used, then compatibility with existing systems is maintained, but ability to include reader-specific identifiers like serial numbers is lost
Solution Approach 1:
The patent embeds reader-specific identifiers (serial numbers) within the cryptographic authentication data structures. The serial numbers are incorporated into the authentication tokens and session key derivation processes, allowing device identification to be nested within the security protocol data without requiring separate certificate fields. This nesting approach efficiently combines identification and authentication functions.
Data Source
AI summary
Method (100) for secure communication between a reader (B) and a controller (A) that are configured to communicate with one another, the method comprising the following phases, implemented by the reader (B): a phase (101) of the reader (B) reading apiece of information; a phase (102) of exchanging a public key (BSpubK) of the reader (B) and a public key (ASpubK) of the controller (A); a phase (103) of generating a string of session keys; a phase (104) of confirming the string of keys based on the use of a first session key (k0) of the string of session keys, a protocol phase (105) of secure communication between the reader (B) and the controller (A).