Token-Based Key Generation for Secure Channel Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for secure communication between two computers over a public network rely on public key infrastructure (PKI) or pre-shared keys, which are vulnerable to security breaches and require additional channels for key sharing and updates.
Innovation Solution
A method where two computers generate the same encryption key using tokens sharing a secret seed through a handshake procedure, eliminating the need for PKI or out-of-band channels, and allowing for frequent key updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric encryption with PKI is used for secure communication, then security is improved, but system complexity increases due to requiring certificate authorities and key management infrastructure
Solution Approach 1:
The patent extracts the core functionality of key agreement from the complex PKI infrastructure. Instead of requiring full asymmetric encryption with certificate authorities, the system uses a simplified approach where tokens share a secret seed and independently generate session keys through a handshake procedure, eliminating the need for PKI while maintaining security
Solution Approach 2:
The tokens perform self-service by autonomously generating encryption keys using the shared secret seed and handshake procedure. Each token independently computes the same session key without requiring external key distribution or certificate validation, making the system self-sufficient and reducing infrastructure complexity
2Ease of operation
If pre-shared keys are used for secure communication, then key distribution is simplified, but key updates become difficult when keys are compromised
Solution Approach 1:
The system transforms static pre-shared keys into dynamic session keys that change over time. The tokens use the shared secret seed combined with a handshake procedure to generate different encryption keys for each communication session, enabling automatic key rotation and updates without requiring manual reconfiguration
Solution Approach 2:
The handshake procedure enables periodic key generation and rotation. Tokens can independently generate new session keys at regular intervals or for each communication session, providing automatic key updates that maintain security while preserving the simplicity of pre-shared key distribution
3Reliability
If standard public key encryption is used, then secure communication is achieved, but vulnerability increases if the encryption algorithm is broken
Solution Approach 1:
The system uses disposable session keys generated through the handshake procedure instead of relying on long-term cryptographic algorithms. Each session key is short-lived and used only for a specific communication session, so even if cryptographic algorithms are broken, the damage is limited to that specific session and does not compromise past or future communications
Solution Approach 2:
The system combines the shared secret seed with dynamic elements from the handshake procedure to create composite session keys. This layered approach provides security that is not dependent on a single cryptographic algorithm's strength, as the session key derives from multiple sources including the secret seed and handshake exchanges
Data Source
AI summary
One embodiment is directed to a method performed by a computing device. The method includes (a) engaging in a handshake procedure with a remote second computing device to establish a secure channel, (b) generating a first encryption key using a first token having a secret seed, the first encryption key being the same as a second encryption key generated by the second computing device using a second token having the same secret seed, and (c) using the first encryption key to engage in encrypted communications with the second computing device. Other embodiments are directed to a computerized apparatus and a computer program product for performing a method similar to that described above.