SPI Transform Key Exchange for Secure Endpoint Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing secure key exchange (SKE) systems generate a Security Parameter Index (SPI) using a random number generator without association with other values, leading to limitations in secure data transfer between endpoints.

Innovation Solution

Implementing SKE messaging using an SPI Transform to enhance secure data transfer by enabling additional functions for a Security Association (SA) between endpoints, including hardware acceleration and secure data transfer between computing nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a random number generator is used to generate SPI without association with other values, then the SPI generation is simple and fast, but the security and functionality of the secure data transfer is limited

Engineering Contradiction:

ImprovesecurityVSAvoidSPI generation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary transformation process that converts a randomly generated base SPI into a final SPI value using additional parameters (shift amount and mask). This mediator mechanism enhances security by associating the SPI with other values while maintaining the simplicity of random generation, thus resolving the contradiction between security improvement and complexity increase.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies parameter changes by modifying the base SPI through bitwise operations (shifting and masking) to generate the final SPI. This transforms the simple random value into a more secure and functional SPI that is associated with other security parameters, improving reliability without requiring a complete redesign of the generation process.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If conventional SPI generation methods are used, then the system is easy to implement, but additional functions such as hardware acceleration and enhanced secure data transfer cannot be enabled

Engineering Contradiction:

Improvefunctional capabilitiesVSAvoidimplementation ease

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

The enhanced SPI generation mechanism serves multiple functions: it provides secure key exchange, enables hardware acceleration, and supports enhanced secure data transfer between endpoints. By making the SPI generation process multi-functional through the addition of transformation parameters, the system achieves versatility without requiring separate mechanisms for each function.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent performs preliminary actions by pre-defining the transformation parameters (shift amount and mask) that will be applied to the base SPI. This preliminary configuration enables the system to support multiple functions including hardware acceleration and enhanced security, while keeping the actual implementation straightforward by reusing existing random number generation capabilities.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If SPI is generated without association with other values, then the generation process is straightforward, but secure communication between endpoints is insufficient

Engineering Contradiction:

Improvesecure communicationVSAvoidSPI generation process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The transformation parameters (shift amount and mask) act as intermediaries that associate the base SPI with other security values. This intermediary layer enhances secure communication by creating a more complex and secure SPI derivation process while maintaining a clear and manageable structure, thus improving reliability without excessive complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent uses parameter changes (bitwise shift and mask operations) to transform the base SPI into a more secure final SPI value. This approach improves secure communication by associating the SPI with additional parameters while keeping the generation process relatively simple through the use of standard bitwise operations.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12476797B2Generating a secure key exchange authentication response using a security parameter index transform

Publication Date: 2025.11.18 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Disclosed embodiments provide systems and methods for generating an SKE Authentication Response using a Security Parameter Index (SPI) Transform to provide secure data transfer in a computing environment. A disclosed method comprises receiving, from an initiator channel on an initiator node, a SKE Authentication Request message at a local key manager (LKM) executing a responder node to initiate a secure communication between the initiator channel and a responder channel. The LKM obtains a Security Parameter Index (SPI) Transform, an SA Index, and SPI Transform values. The LKM creates an SPI based on the SPI Transform using the SA Index and the SPI Transform values. The LKM builds an SKE Authentication Response message based on the SKE Authentication Request message and the SPI, which including the SPI and an encryption algorithm. The LKM transmits the SKE Authentication Response message to the initiator channel on the initiator node using the responder channel.