Self-Certified Identity-Based Private Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity-based cryptographic schemes face challenges in generating private keys that are not escrowed to a Key Generation Centre, leading to vulnerabilities in authentication and key exchange, especially in the context of the Internet of Things where scalability and mobility are critical.
Innovation Solution
A system and method for generating private keys for devices in a self-certified identity-based signature scheme, where the private keys are computed using a secure server and a random number, ensuring they are only known to the devices themselves, allowing for cross-domain authenticated key exchange and compatibility with existing schemes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If identity-based cryptographic schemes are used to generate private keys through a Key Generation Centre, then authentication and key exchange can be established, but the private keys become escrowed to the Key Generation Centre creating security vulnerabilities
Solution Approach 1:
The patent extracts the master secret key from the Key Generation Centre and replaces it with a randomly generated private key that is never exposed to any external party. This removes the key escrow vulnerability by eliminating the centralized authority that holds all private keys, while still enabling authentication through the use of device-specific random values and identity-based signature schemes.
Solution Approach 2:
Each device generates its own private key locally using a random number generator without requiring the Key Generation Centre to create or manage it. The device independently computes its private key and uses it for authentication, making the system self-service oriented and eliminating dependency on a potentially compromised central authority.
2Reliability
If pre-shared symmetric secret keys are used for establishing secret keys between entities, then authentication can be verified, but the method is not scalable and requires pre-sharing with all trusted entities
Solution Approach 1:
The patent segments the key management system by assigning each device its own unique private key derived from its identity and a random value, rather than requiring all devices to share a common secret. This segmentation enables scalable authentication where each device independently manages its own credentials without complex pre-sharing arrangements.
Solution Approach 2:
The patent transitions from a two-dimensional key sharing model (where all parties share one common key) to a multi-dimensional model where each party has its own private key but can derive shared secrets with others. This dimensional change enables scalable authentication while maintaining security through identity-based cryptography.
3Reliability
If public key infrastructure based solutions are used with public key certificates, then entity authenticity can be verified, but the setup and maintenance is expensive and requires constant contact with PKI server
Solution Approach 1:
The patent enables devices to self-verify authenticity using identity-based signature schemes where each device has its own private key and can prove its identity without contacting a central PKI server. This self-service capability eliminates the need for expensive and energy-consuming continuous server contact while maintaining strong authentication guarantees.
Solution Approach 2:
The patent extracts the authentication verification capability from the centralized PKI server and embeds it in each device through identity-based cryptography. This allows devices to independently verify authenticity locally without requiring constant server interaction, significantly reducing operational costs and energy consumption.
4Reliability
If bilinear pairing is used in identity based cryptosystems for entity authentication, then identity-based private keys can be derived, but the computation process is expensive and time consuming
Solution Approach 1:
The patent replaces expensive bilinear pairing operations with more efficient cryptographic primitives such as elliptic curve cryptography and hash functions. By using computationally lighter operations that achieve the same security goals, the system reduces computation time and resource consumption while maintaining identity-based authentication capabilities.
Solution Approach 2:
The patent changes the cryptographic parameters from bilinear pairing-based constructions to more efficient alternatives such as pairing-free identity-based signature schemes. This parameter change maintains the security properties of identity-based cryptography while dramatically reducing computational overhead and execution time.
Data Source
AI summary
A system and method generate private keys for devices participating in a self-certified identity based encryption scheme. A private key is used by the devices to establish a common session key for encoding digital communications between devices.