Third Secured Entity for TLS Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing TLS stack is entirely executed on a single computer, which fails to separate authentication and information exchange procedures, leading to potential key usurpation and insecurity, especially in complex operating systems vulnerable to malicious software.
Innovation Solution
Implementing a third secured entity, such as a JavaCard chip card, to generate and transmit securing data for establishing a secure session, thereby relocating critical authentication steps to a trusted environment and dissociating the security protocol from the device implementing the session.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the TLS stack is entirely executed on a single computer, then the device complexity is reduced and ease of operation is improved, but security reliability deteriorates due to potential key usurpation and vulnerability to malicious software
Solution Approach 1:
The patent segments the authentication process into two distinct parts: a secure element (such as a JavaCard chip card) that generates and protects cryptographic keys, and a host computer that executes the TLS protocol. This segmentation isolates the critical key generation function in a secure environment while allowing the rest of the system to operate with standard complexity.
Solution Approach 2:
The patent introduces a secure element as an intermediary between the host computer and the authentication process. This secure element acts as a trusted mediator that performs key generation and protection functions, thereby enhancing security reliability without requiring the host computer itself to become more complex or secure.
2Reliability
If authentication procedures are separated from information exchange procedures, then security reliability is improved by preventing key usurpation, but device complexity increases due to multiple entities
Solution Approach 1:
The patent separates authentication procedures into a distinct secure element that handles key generation and protection, while the host computer handles information exchange. This functional segmentation ensures that authentication and information exchange are physically and logically separated, preventing key usurpation while maintaining manageable system complexity through clear division of responsibilities.
Solution Approach 2:
The patent extracts the critical authentication function (key generation and protection) from the host computer and places it in a separate secure element. This extraction isolates the security-critical operations from the potentially vulnerable host environment, improving reliability without requiring the entire system to become more complex.
3Reliability
If a third secured entity is introduced to generate securing data, then security reliability is enhanced by creating authentication in a secure environment, but ease of operation deteriorates due to additional setup requirements
Solution Approach 1:
The patent introduces a secure element as an intermediary that automatically handles the complex authentication processes. While the initial setup requires introducing this additional entity, the secure element then autonomously manages key generation and protection, actually simplifying the ongoing operation for the user compared to manually managing security on the host computer.
Data Source
AI summary
A method is provided for producing securing data for implementing a secured session between a first and at least a second entity based on a protocol for establishing secured sessions. The method includes setting up a third secured entity related to the first entity; generating at least a portion of the securing data within the third entity; and transmitting the securing data from the secured third entity to the first entity.