Pair-wise Keying for VPN Gateway Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual private network (VPN) systems using group keying methods are vulnerable to eavesdropping and spoofing attacks, particularly when VPN gateways are not physically secured, as an attacker can compromise one gateway to decrypt or spoof traffic across the entire network.
Innovation Solution
Implementing pair-wise keying using the Group Domain of Interpretation (GDOI) and Blom Symmetric Key Generation System (SKGS) to derive unique keys for each VPN gateway, ensuring that compromised keys do not affect other gateways and providing collusion resistance, while maintaining scalability and efficient key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If group keying is used to maintain scalability of VPN gateways, then the system can handle large numbers of gateways efficiently, but security is compromised because an attacker can eavesdrop on all traffic and spoof any gateway if one gateway's keys are revealed
Solution Approach 1:
The patent segments the single group key into multiple pair-wise keys, where each VPN gateway has a unique key shared only with specific peer gateways. This is achieved through the Blom SKGS which generates unique keying material for each gateway pair, thereby maintaining scalability while improving security against key compromise.
Solution Approach 2:
The patent applies local quality by providing different security characteristics to different gateway pairs. Instead of uniform group keying where all gateways share the same security level, each gateway receives customized pair-wise keys appropriate to its specific communication needs, enhancing overall system security while maintaining scalability.
2Reliability
If pair-wise keying is implemented to improve security by providing unique keys for each gateway, then security against eavesdropping and spoofing is enhanced, but system complexity increases
Solution Approach 1:
The patent introduces a Key Generation Server (KGS) as an intermediary that automatically generates and distributes pair-wise keys to VPN gateways using the Blom SKGS algorithm. This intermediary handles the complex key management operations, reducing the burden on individual gateways and simplifying overall system deployment while maintaining strong security.
Solution Approach 2:
The patent changes the key management parameter from static group keys to dynamic pair-wise keys generated on-demand. The Blom SKGS enables keys to be derived as needed based on gateway identities, transforming the key management approach from pre-configured to dynamically generated, thereby reducing complexity while enhancing security.
3Device complexity
If all VPN gateways use the same group keys, then key distribution is simplified and scalability is maintained, but the system becomes vulnerable to collusion attacks when multiple gateways are compromised
Solution Approach 1:
The patent segments the key distribution system so that each gateway receives unique pair-wise keys rather than sharing a common group key. The Blom SKGS generates distinct keying material for each gateway pair, preventing collusion attacks while maintaining simplified key distribution through the automated Key Generation Server.
Data Source
AI summary
In an embodiment, a method for generating and distributing keys retains the scalability of a group VPN, but also provides true pair-wise keying such that an attacker who compromises one of the devices in a VPN cannot use the keys gained to decrypt the packets from the other gateways in the VPN, or spoof one of the communicating gateways. The method is collusion resistant when co-operating attackers overtake several VPN gateways and observe the keys stored in those gateways. In an embodiment, a VPN gateway comprises a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic; and Key Generation System logic. In one approach a gateway performs, in relation to adding a group member, receiving in a security association message secret data for use in the KGS; and derives keys for secure communication with one or more peer VPN gateways using the secret data.