Terminal Session Encryption Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods over networks are vulnerable to hacking, as public encryption keys can be intercepted and used to impersonate users, allowing unauthorized access and decryption of data.
Innovation Solution
Implementing an encryption method where the encryption key is specific to each user and generated locally on a terminal, changing with each access session, and not transmitted over the network, making it difficult for hackers to intercept and use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a public key is used for encryption, then data can be transmitted over the network, but the public key can be intercepted by hackers allowing impersonation and unauthorized decryption
Solution Approach 1:
The patent extracts the encryption key from the network transmission environment and keeps it exclusively within the terminal device. The key is generated locally on the terminal and never leaves the device, eliminating the vulnerability of key interception during network transmission while maintaining data encryption capabilities.
Solution Approach 2:
The patent introduces a session identifier as an intermediary mechanism. Instead of transmitting the encryption key itself, the system uses a session identifier that can be safely transmitted over the network. This intermediary allows key management without exposing the actual encryption key to network transmission risks.
2Ease of operation
If an encryption key is transmitted from authentication server to terminal, then the terminal can encrypt data, but the transmitted key can be intercepted during transmission
Solution Approach 1:
The terminal device performs self-service by autonomously generating its own encryption key locally without requiring key transmission from an authentication server. This eliminates the need for secure key distribution infrastructure while maintaining encryption functionality. The terminal independently manages its own cryptographic materials.
Solution Approach 2:
The encryption key is generated in advance within the terminal device before any network communication occurs. This preliminary key generation ensures that the key is already available for encryption operations without requiring subsequent transmission or distribution, preventing interception vulnerabilities.
3Device complexity
If the same encryption key is used across multiple user sessions, then encryption is simpler, but a hacker who guesses one key can decrypt all sessions
Solution Approach 1:
The patent implements dynamic key management where the encryption key changes with each user session. The terminal generates a new encryption key for each session based on session-specific parameters, ensuring that even if one session's key is compromised, other sessions remain secure. This dynamic approach balances security requirements with operational simplicity.
Solution Approach 2:
The patent segments the encryption key into session-specific components. Instead of using a single long-term key, the system creates multiple short-term session keys that are independent of each other. This segmentation ensures that compromise of one session key does not affect the security of other sessions while maintaining manageable complexity.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
The invention proposes an encryption method implemented by a terminal comprising an operating system that can be accessed by several users and an encryption module for encrypting data intended for another terminal, the method comprising a detection step (100) for detecting when a session for accessing the operating system is opened by a user, and, in response to the detection of such a session being opened, a step (104) of setting the parameters of the encryption module with an encryption key unique to the user for encrypting data intended for another terminal, in which the encryption key is generated (101) by the terminal, or is stored in a memory (16, 22) of the terminal before the detection (100) of a session accessing the operating system being opened.