Session Key Exchange Without TLS or Pre-Shared Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key exchange procedures suffer from high latency, overhead, and security vulnerabilities, making them unsuitable for large networks or isolated enterprise environments.
Innovation Solution
A key exchange protocol using a session key generated from public and private keys, enabling secure encryption and authentication without relying on TLS connections, pre-shared keys, or third-party CAs, utilizing a hardware key vault for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS connection is used to communicate cipher key over public channel, then security is improved, but latency and overhead increase
Solution Approach 1:
The patent extracts the key exchange process from the TLS handshake protocol, allowing cipher keys to be exchanged independently without completing the full TLS handshake. This separation enables faster key exchange by eliminating unnecessary handshake steps while maintaining security through direct authenticated key transmission between parties.
Solution Approach 2:
The patent performs authentication and key exchange preparations in advance by establishing trusted certificates and public keys before actual communication begins. This preliminary setup allows subsequent key exchanges to occur rapidly without repeated authentication handshakes, reducing latency while maintaining security verification.
2Device complexity
If pre-shared symmetrical keys are used for key exchange, then key management overhead is reduced, but scalability is worsened due to twice the overhead for both parties to maintain keys
Solution Approach 1:
The patent implements asymmetric key management where only the server maintains private keys and certificates, while clients hold only public keys and temporary session keys. This asymmetric distribution eliminates the need for both parties to maintain identical key sets, reducing overall key management overhead from twice to once per connection while enabling scalable deployment across large networks.
Solution Approach 2:
The patent introduces server-side certificates and public keys as intermediaries that enable secure key exchange without requiring pre-shared secrets between all parties. The server acts as a key management intermediary that distributes session keys to multiple clients independently, eliminating the need for each client to maintain copies of other clients' keys, thus improving scalability.
3Measurement precision
If third party CA is used to certify cipher key exchange, then verification is improved, but security is worsened due to trust requirements and internet connection dependency
Solution Approach 1:
The patent implements self-service authentication where the server uses its own privately-held certificates and keys to authenticate itself and issue session keys to clients. This eliminates dependency on external third-party CAs and internet connections, allowing isolated networks to perform secure key exchange independently while maintaining verification accuracy through cryptographic proof of server identity.
Data Source
Figure 1~5
Figure 2
Figure 6~8
AI summary
A method for securely receiving a cipher key from a key provider to a key requester is provided. The method includes generating a session key shared between the key requester and the key provider, determining at least one key in accordance with the session key. The method also includes transmitting a request from the key requester to the key provider, and receiving a response from the key provider, where the response comprises an encrypted payload and an authentication tag. The method also includes authenticating the response and decrypting the encrypted payload using the at least one key to obtain the cipher key.