Verifier-Based Message Key Envelope for Offline Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure communication systems face challenges in balancing high security and ease of use, particularly in off-line decryption, where password-based schemes are weak and public key schemes are complex and difficult to deploy.
Innovation Solution
A secure communication system that encrypts message keys based on a verifier related to the recipient's secret, allowing for both on-line and off-line decryption capabilities, reducing reliance on password-derived keys and complex public key infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a password-based scheme is used for off-line decryption, then ease of use is improved, but security deteriorates due to susceptibility to dictionary attacks and brute force attacks
Solution Approach 1:
The patent introduces a key server as an intermediary between senders and recipients for key management. The key server stores message keys and manages key distribution, allowing recipients to retrieve keys offline without directly sharing passwords or public keys. This mediator approach resolves the contradiction by providing secure key management (improving security) while maintaining user-friendly access through the key server interface (preserving ease of use).
Solution Approach 2:
The patent creates encrypted copies of message keys that can be stored and transmitted separately from the actual messages. These key copies are encrypted using the recipient's public key and can be retrieved offline. This copying mechanism allows the system to maintain security through proper encryption while enabling flexible offline access (ease of use) without requiring the recipient to be present during key generation.
2Reliability
If public key enveloping is used for off-line decryption, then security is improved, but device complexity increases due to requirements for public key infrastructure and key management
Solution Approach 1:
The patent combines the key generation, storage, and distribution functions into a single key server system. Instead of requiring separate public key infrastructure components and manual key management procedures, the key server merges these functions into one centralized service. This merging maintains the security benefits of public key cryptography while significantly reducing the operational complexity for users, who only need to interact with the simplified key server interface.
Solution Approach 2:
The system performs preliminary key generation and encryption actions through the key server before messages need to be decrypted. Message keys are generated and encrypted in advance, and key distribution policies are established beforehand. This preliminary action allows recipients to have their keys ready offline without needing to perform complex key management operations at the moment of decryption, reducing immediate operational complexity while maintaining security.
3Reliability
If on-line key server communication is required for decryption, then security is improved through centralized key management, but productivity deteriorates due to dependency on continuous network connectivity
Solution Approach 1:
The key server performs preliminary key generation, encryption, and distribution actions before messages need to be accessed. Recipients can retrieve their encrypted message keys from the key server in advance and store them locally. This preliminary action enables offline decryption capability, allowing users to maintain security through centralized key management while improving productivity by eliminating the need for continuous network connectivity during message decryption.
Data Source
AI summary
A secure communication system wherein message decryption may be performed while off-line, or optionally while on-line. A sender encrypts a message based on the message key and sends it to the recipient. An envelope containing a message key is created by encrypting the message key based on a verifier, where the verifier is based on a secret of the recipient. The recipient is provided the envelope, along with the message or separately, from the sender or from another party, contemporaneous with receipt of the message or otherwise. The recipient can then open the envelope while off-line, based on their secret, and retrieve the message key from the envelope to decrypt the message. In the event the recipient cannot open the envelope, optional on-line access permits obtaining assistance that may include obtaining an alternate envelope that the recipient can open.