Session Key Derivation Across Multiple Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently managing session keys across multiple servers, leading to computational expenses and security risks due to the need for frequent key generation and storage.
Innovation Solution
A method where a first server generates a session key with a client and stores information for the client to recreate the key if needed, allowing a second server to derive the session key without re-establishing it, reducing the burden on clients and servers and eliminating the need for central key storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new session key is generated for every communication between client and server, then security is improved, but computational cost increases
Solution Approach 1:
The system performs preliminary key generation between the client and the first server before the client needs to communicate with other servers. The derived key material is stored by the client and can be used later to efficiently derive session keys when communicating with second servers, avoiding the need to perform full key generation computations during each communication session.
2Ease of operation
If session keys are stored on servers, then key management is simplified, but security risks increase
Solution Approach 1:
The system extracts the session key storage function from the servers and relocates it to the client device. The client stores derived key material locally, while servers only store minimal identifying information. When a second server needs to communicate with the client, it requests the derived key material from the client, eliminating the need for servers to store sensitive session keys.
3Adaptability or versatility
If a client communicates with multiple servers, then system flexibility is improved, but key management complexity increases
Solution Approach 1:
The system creates a universal key derivation mechanism where a single initial key exchange between the client and the first server produces derived key material that can be used across multiple servers. The second server can derive the necessary session key using the same client identifier and derived key material, making the key management system universally applicable across the entire server pool without increasing client-side complexity.
Data Source
AI summary
The various examples are directed to establishing a secure session between a device and a server. The device and the server may establish a session key. The session key may be used for encrypting data. After authenticating the session key, the server may transmit secure session data to the device, and the device may store the secure session data. The server may transmit information for deriving, based on secure session data, the session key to a different server. The device may transmit the secure session data to the server, or to the different server, to re-establish the secure session. The different server may derive, using the information and based on the secure session data, the session key. The different server may re-establish, using the session key, the secure session.