Trusted Third Party Key Distribution for Resource-Constrained Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices with limited processing power face challenges in securely communicating shared cryptographic keys due to computationally intensive methods required for key exchange, such as Diffie-Hellman key exchange, which are not feasible for devices like nonvolatile boot devices in computing systems.
Innovation Solution
A method using a shared symmetric key approach and a trusted third party to securely communicate the shared key, where a unique identifier and signature are used to verify the key, allowing secure communication without exposing the key on insecure channels and minimizing computational requirements for devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Diffie-Hellman key exchange is used to securely communicate shared keys, then security is improved, but computational complexity increases
Solution Approach 1:
A trusted third party (key distribution center) is introduced as an intermediary to facilitate secure key exchange. Instead of requiring direct computational key exchange between devices, the third party generates and distributes pre-shared keys, eliminating the need for complex Diffie-Hellman calculations on resource-constrained devices while maintaining security through the trusted intermediary.
Solution Approach 2:
Keys are pre-generated and distributed by the trusted third party before actual communication occurs. This preliminary key distribution action eliminates the need for computationally intensive real-time key exchange calculations, allowing devices with limited processing power to securely communicate without performing complex mathematical operations.
2Reliability
If extensive mathematical calculations are performed for key exchange, then key security is improved, but processing power requirements increase
Solution Approach 1:
The trusted third party performs the computationally intensive key generation and distribution operations, freeing resource-constrained devices from the burden of performing complex mathematical calculations. The intermediary absorbs the processing power requirements while maintaining key security through its trusted status.
Solution Approach 2:
Instead of each device performing complex calculations to derive shared keys independently, the system uses pre-computed and distributed key copies from the trusted third party. This eliminates redundant computational efforts while maintaining security, as the pre-generated keys are already optimized for the specific communication pairs.
3Adaptability or versatility
If shared keys are communicated over insecure channels, then communication flexibility is improved, but security risk increases
Solution Approach 1:
The trusted third party acts as a secure conduit that receives keys from one device, verifies them, and distributes them to another device over potentially insecure channels. This intermediary approach allows communication flexibility through the third party while mitigating security risks by ensuring key integrity through verification mechanisms.
Solution Approach 2:
Keys are pre-verified and prepared by the trusted third party before being transmitted to communicating devices. This preliminary verification action ensures that even if communication channels are insecure, the keys themselves remain secure because they have been pre-checked for validity and authenticity by the trusted intermediary.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
Systems and methods used to securely communicate a shared key to devices. One embodiment describes a method to securely communicate a shared key to a first device (32) and a second device (34) that includes receiving (52), using the first device, a shared key and unique identifier pairing associated with the first device (32) from a key generator (36); receiving (54), using a trusted third party (38), the shared key and unique identifier pairing from the key generator (36); generating (80), using the first device (32), a signature using the unique identifier and the shared key; transmitting (82), using the first device (32), the signature and the unique identifier to the trusted third party (38); verifying (86), using the trusted third party (38), the unique identifier based on the signature; determining, using the trusted third party (38), the shared key when the unique identifier is verified; and transmitting (88), using the trusted third party (38), the shared key to the second device (34) to enable the first device (32) and the second device (34) to communicate securely by encoding and decoding communicated data using the shared key.