Symmetric Key Generation System for Scalable Mesh Network Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security schemes for mesh networks, such as pairwise shared secrets, shared secrets with a key server, certificates, and group key systems, face scalability issues, performance impacts, and management complexities, particularly affecting battery life and requiring public key infrastructure, while also being vulnerable to key exposure and revocation challenges.
Innovation Solution
A symmetric key generation system (KGS) that uses a set of crypto variables, including a secret key and public identifier, to establish a secure group identity, allowing any two members to derive a session key without exposing the entire group to key compromise, and incorporates an epoch value for key rotation and revocation, reducing storage needs and avoiding complex public key computations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pairwise shared secrets are used for key management, then authentication between mesh participants is enabled, but the system does not scale well as the network grows
Solution Approach 1:
The patent segments the key management system into two parts: a group-shared symmetric key stored in read-only memory for efficient authentication, and individual private keys stored in secure elements for secure key derivation. This segmentation allows scalable authentication without requiring complex pairwise key management between all participants.
Solution Approach 2:
The patent introduces a key server as an intermediary that provisions initial keys to mesh participants. The key server acts as a trusted mediator that enables authentication without requiring direct complex key relationships between all pairs of participants, thus simplifying key management as the network scales.
2Ease of operation
If shared secrets with a key server are used, then key exchange and authentication are facilitated, but the system fails if the key server is not available
Solution Approach 1:
The patent implements preliminary action by having mesh participants store group-shared symmetric keys and individual private keys in secure storage before joining the mesh network. This pre-provisioning of keys in read-only memory and secure elements enables participants to perform authentication and key derivation independently without requiring real-time key server availability.
Solution Approach 2:
The patent enables self-service by allowing mesh participants to autonomously derive pairwise keys and perform authentication using their pre-stored group key and private key. Participants can independently generate session keys and authenticate with other mesh members without continuous reliance on the key server, thus improving system availability.
3Reliability
If certificates and key pairs are used for authentication, then mesh participants can authenticate with each other, but performance and battery life are negatively impacted
Solution Approach 1:
The patent replaces expensive, computationally intensive public key infrastructure with a simpler, more efficient symmetric key-based approach. By using pre-shared symmetric keys stored in read-only memory and secure elements, the system achieves authentication capability with minimal computational overhead and energy consumption, effectively using simpler cryptographic primitives instead of complex certificate-based systems.
4Device complexity
If a group key system is used where all mesh nodes share the same key, then key management is simplified, but any member can impersonate any other member
Solution Approach 1:
The patent introduces asymmetry into the group key system by combining a shared symmetric group key with individual private keys stored in secure elements. While all participants share the same group key for efficient authentication, each participant's unique private key ensures that they cannot impersonate others. This asymmetric structure maintains key management simplicity while preventing unauthorized impersonation.
Solution Approach 2:
The patent applies local quality by having each mesh participant possess the same group-shared symmetric key (common property) while simultaneously having their own unique private key (individual property). This combination of shared and unique characteristics at the local level enables both efficient group authentication and individual identity verification, preventing impersonation while maintaining simplicity.
5Device complexity
If a group key system is used, then key management is simplified, but revocation requires a complete rekey
Solution Approach 1:
The patent extracts the revocation mechanism from the group key itself by maintaining individual private keys in secure elements for each participant. When a participant needs to be revoked, their individual private key can be independently invalidated or removed without affecting the shared group key or requiring rekeying of all other participants. This separation of group authentication from individual identity enables efficient revocation.
Data Source
AI summary
In an example embodiment, a key generation system (KGS) is used to generate private pairwise keys between peers belonging to a group. Each member of the group is provisioned with a set of parameters which allows each member to generate a key with any other member of the group; however, no group member can derive a key for pairings involving other group members. The private pairwise keys may be used to derive session keys between peers belonging to the group. Optionally, an epoch value may be employed to derive the private pairwise keys.