Semi-Trusted Intermediaries for Secure Message Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure message passing techniques using intermediaries are vulnerable to attacks and costly due to the need for trusted relationships and complex key management, especially in large-scale environments.
Innovation Solution
A method employing two semi-trusted intermediaries for key encryption and message passing, using symmetric encryption and a guard key to securely transmit and decrypt message encryption keys, reducing complexity and cost while maintaining message confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single trusted intermediary is used to pass encrypted messages, then message confidentiality is maintained, but system complexity and cost increase due to key management requirements
Solution Approach 1:
The patent divides the intermediary function into two separate components: a first intermediary that handles key encryption/decryption and a second intermediary that handles message routing. This segmentation eliminates the need for complex key management at a single trusted intermediary, as the message-encrypting key never leaves the sender's device in encrypted form.
Solution Approach 2:
The patent introduces two semi-trusted intermediaries with specific divided roles: the first intermediary acts as a key encryption service that protects the message-encrypting key, while the second intermediary acts as a message relay that handles only encrypted messages. This intermediary structure maintains security without requiring either intermediary to have full access to unencrypted messages or keys.
2Productivity
If symmetric encryption is used for message passing, then encryption efficiency improves, but security vulnerabilities increase if intermediaries are compromised
Solution Approach 1:
By segmenting the intermediary functions and using asymmetric encryption for the key exchange phase (sender to first intermediary) and symmetric encryption for the message phase, the system maintains efficiency while improving security. The message-encrypting key is never stored or processed in plaintext by intermediaries.
Solution Approach 2:
The patent employs a composite encryption approach combining asymmetric encryption (for key protection during transmission to intermediaries) and symmetric encryption (for efficient message encryption). This composite method leverages the security strengths of asymmetric encryption for key management while maintaining the efficiency of symmetric encryption for bulk message encryption.
3Reliability
If multiple intermediaries are used for key encryption and message passing, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent clearly segments the responsibilities of two intermediaries: the first intermediary only handles key encryption/decryption operations, while the second intermediary only handles message routing and delivery. This functional segmentation simplifies the coordination complexity compared to a single full-featured intermediary, as each component has a narrow, well-defined role.
Solution Approach 2:
The patent uses two specialized intermediaries with complementary functions that together provide enhanced security. The first intermediary protects the key infrastructure, while the second intermediary protects the message infrastructure. This division reduces coordination complexity because each intermediary interacts with only one type of data (keys or messages) and has dedicated protocols for each.
Data Source
AI summary
Techniques are provided for secure message passing. A sender process has a clear (non-encrypted) text message to pass to a recipient process as an encrypted message. The sender generates a message encryption key (MEK) for encrypting the message and sends the MEK to a first intermediary process, which encrypts the MEK. The sender uses the MEK to encrypt the message and passes both the encrypted message and the encrypted MEK to a second intermediary process. The second intermediary verifies that the sender is authorized to send messages and retains the encrypted message and the encrypted MEK. The second intermediary passes the encrypted message and the encrypted MEK to the recipient, which requests decryption of the encrypted MEK from the first intermediary. The first intermediary then decrypts the MEK and returns it to the recipient. Finally, the recipient decrypts the message using the MEK.