Secure Key Exchange via Server-Pushed Activation Password

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for establishing a shared secret between a wireless communications device and an internet service for secure key exchange are inefficient, particularly when users lack physical access to the device and require multiple user interfaces or administrative intervention, such as in consumer settings.

Innovation Solution

A method where the internet service generates and transmits a shared secret, including an activation password and service UID, over a secure channel to the device, allowing the device to initiate a SPEKE-like key exchange without needing to monitor a user's mailbox or require administrative intervention, using HTTPS and custom content handlers or browser plug-ins for authentication and key generation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the device monitors the user's mailbox for initial key exchange commands, then the key exchange can be initiated, but the process becomes inefficient and requires administrative intervention when users lack physical access to the device

Engineering Contradiction:

Improveease of account setupVSAvoidcomplexity of key exchange process

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

Instead of the device monitoring the mailbox for key exchange commands, the system inverts the approach by having the server proactively push the initial key exchange command and activation password directly to the device through alternative channels (such as SMS or direct API calls), eliminating the need for mailbox monitoring and administrative intervention

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces an intermediary mechanism that facilitates direct communication between the server and device without requiring mailbox monitoring. This intermediary channel allows the activation password and initial key exchange command to be transmitted directly to the device, simplifying the setup process even when users lack physical access

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If multiple user interfaces are used for service setup (browser on handheld or PC), then flexibility is improved, but the establishment of symmetric key becomes more complex and time-consuming

Engineering Contradiction:

Improveflexibility of setup interfaceVSAvoidtime for key establishment

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-generating and storing the activation password on the server before the actual key exchange process. When a user initiates setup from any interface (handheld browser or PC), the activation password is already ready, eliminating delays associated with generation and transmission through multiple interfaces

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements a universal activation mechanism that works across multiple user interfaces (handheld browser, PC browser, mobile devices) through a common protocol. The activation password and key exchange process are designed to be interface-agnostic, allowing setup to begin immediately from any supported platform without requiring interface-specific procedures

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If the activation password is communicated through administrative channels, then security is maintained, but the process requires unnecessary administrative intervention in consumer settings

Engineering Contradiction:

Improvesecurity of key exchangeVSAvoidindependence from administrator

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements a self-service mechanism where users can independently complete account setup and key exchange without administrative intervention. The server automatically provides the activation password and facilitates the key exchange process, allowing consumers to set up their own accounts while maintaining security through the standardized protocol

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The activation password is pre-generated and stored securely on the server in advance, ready for immediate retrieval during the key exchange process. This preliminary preparation eliminates the need for real-time administrative involvement while maintaining security, as the password is already prepared and can be automatically transmitted to the user's device

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8904179B2System and method for exchanging key generation parameters for secure communications

Publication Date: 2014.12.02 MALIKIE INNOVATIONS LTD

AI summary

A communication system exchanges key generation parameters for secure communications. An internet service and communications device of a user are in communication with each other. The internet service includes an account authentication mechanism for a user and includes a database having stored cryptographic keys and key generation parameters. A device client operates on the communications device and initiates a request to the internet service that authenticates the user and establishes a secure communications channel between the internet service and communications device and determines key generation parameters based on an authenticated user identifier and transmits the key generation parameters for initiating key generation and securely establishing a cryptographic key between the internet service and communications device.