TLS Concatenation via Unique PSK Identity Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in determining a unique pre-shared key (PSK) identity for Transport Layer Security (TLS) and managing TLS concatenation, leading to issues with secure channel establishment and potential security vulnerabilities.
Innovation Solution
The system generates a TLS pre-shared key (PSK) and derives a unique PSK identity associated with the TLS PSK, using a shared session key and PSK digest to establish a secure TLS negotiation and manage TLS concatenation effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS concatenation is implemented without unique PSK identity derivation, then TLS negotiation can proceed with existing PSK infrastructure, but security vulnerabilities arise due to inability to distinguish between different PSK instances
Solution Approach 1:
The patent segments the PSK identification by deriving a unique PSK identity for each TLS connection instance using connection-specific parameters (source/destination IPs, ports, protocol identifiers). This segmentation allows the system to distinguish between different PSK instances while maintaining the overall PSK infrastructure, resolving the security vulnerability without requiring complete redesign of PSK management.
Solution Approach 2:
The patent performs preliminary PSK identity derivation during the TLS handshake process before actual data transmission begins. By pre-establishing the unique PSK identity and validating it against the connection parameters, the system proactively prevents security vulnerabilities rather than reacting to them later, while keeping the implementation integrated within the existing TLS negotiation flow.
2Reliability
If unique PSK identity is derived for each TLS connection, then security is enhanced through proper PSK distinction, but additional computational overhead is introduced in PSK derivation and validation
Solution Approach 1:
The patent changes the parameters used for PSK identity derivation by incorporating connection-specific elements (source/destination IP addresses, port numbers, protocol identifiers) into the identity derivation process. This approach generates unique PSK identities without requiring additional cryptographic key generation, thereby enhancing security while minimizing computational overhead by reusing existing connection parameters.
3Ease of operation
If TLS negotiation uses shared session key without PSK digest, then negotiation process is simpler, but PSK identity cannot be uniquely determined leading to security issues
Solution Approach 1:
The patent introduces a PSK digest as an intermediary element that bridges the shared session key and the unique PSK identity. The digest is computed from connection-specific parameters and used to derive the PSK identity during TLS negotiation. This intermediary approach maintains the simplicity of the negotiation process while enabling reliable PSK identity determination, as the digest computation is straightforward and integrates seamlessly into the existing handshake flow.
Data Source
AI summary
Systems and methods for Transport Layer Security (TLS) concatenation are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, wherein the memory comprises program instructions store thereon that, upon execution by the processor, cause the IHS to: derive a shared session key during a first Transmission Control Protocol (TCP) connection with a second IHS; and after disconnection of the first TCP connection, perform a Transport Layer Security (TLS) negotiation with the second IHS via a second TCP connection using the shared session key.