Time-Bound Key Digital Signatures for Resource-Constrained IoT

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing digital signature systems, such as PKI-based systems, face challenges including high computational and storage burdens, reliance on trust in issuing authorities, potential 'back doors' in keys, and incompatibility with devices like smart cards and IoT devices that require low resource usage and secure one-time signatures.

Innovation Solution

The implementation of a one-time digital signature method using Time-Bound Keys (TBKs) and Time-Selected Keys (TSK) systems, which leverage cryptographic hash functions to generate and verify signatures efficiently, reducing key sizes and computational loads, and integrating with distributed hash tree-based infrastructures like Guardtime's KSI system for timestamping and signature generation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If PKI-based signature schemes are used, then digital signatures can be generated and verified, but computational and storage burdens increase significantly

Engineering Contradiction:

Improvedigital signature securityVSAvoidcomputational and storage load

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the signature generation process into two independent parts: (1) a one-time setup phase where a root key pair is generated and a hash chain is created, and (2) a signing phase where individual signatures are derived from the hash chain. This segmentation allows resource-constrained devices to perform only lightweight hash computations during signing, while the computationally intensive key generation and chain creation are done once during setup.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by pre-generating a hash chain of cryptographic values during an initialization phase. The root key is generated in advance, and a sequence of hash values (h1, h2, h3, ...) is pre-computed and stored. During actual signing operations, only simple hash computations are needed to derive signatures from the pre-computed chain, eliminating the need for repeated expensive key generation operations.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If PKI keys are used for multiple documents, then signature service is efficient, but key expiration and security risks increase

Engineering Contradiction:

Improvesignature generation efficiencyVSAvoidkey security and validity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements disposable, short-lived signature credentials derived from a permanent root key. Each signature operation consumes one element from the pre-computed hash chain, creating a unique, non-reusable signature credential. This ensures that even if one signature is compromised, the root key and other signatures remain secure, eliminating key expiration issues while maintaining high security.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The patent creates a dynamic signature system where credentials are generated on-demand from a static root key. The hash chain provides a sequence of evolving signature credentials that change with each use, allowing the system to adapt to different signing requirements while maintaining a single, permanent root key for identity verification.

Inventive Principle:

Principle #15Dynamics

3Reliability

If traditional digital signature systems are implemented on smart devices, then security can be provided, but resource requirements exceed device capabilities

Engineering Contradiction:

Improvedata securityVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent changes the computational parameters of the signature system by replacing expensive asymmetric cryptographic operations with lightweight hash function computations. The system uses symmetric hash-based cryptography instead of asymmetric key pairs, reducing computational complexity from O(n²) or O(n³) to O(n) operations, making it feasible for resource-constrained smart devices while maintaining cryptographic security.

Inventive Principle:

Principle #35Parameter changes

4Reliability

If continuous bidirectional communication is assumed, then signature verification can be performed, but communication availability requirements increase

Engineering Contradiction:

Improvesignature verificationVSAvoidcommunication channel requirements

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements self-service verification by embedding all necessary verification data within the signature itself. The signature includes the public key and hash chain elements needed for verification, allowing any device to verify signatures independently without requiring continuous communication with a central authority. This makes the system adaptable to environments with intermittent or one-way communication channels.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11184176B2System and method for generating data signatures over non-continuously bidirectional communication channels

Publication Date: 2021.11.23 GUARDTIME SA

AI summary

During a period of uni-directional, device-to-collector communication, a digital signature is created for at least one data set based on a public key, which is computed from at least one time-bound secret key. When collector-to-device communication becomes available, the collector signals to the device that the current data collection period may end, at which point the time-bound secret key(s) previously used may be revealed but are not longer usable.