A computer-implemented method to perform a remote authentication communication between a verifier device and a prover device

Abstract

The invention relates to a computer-implemented method to perform a remote authentication communication between a verifier device and a prover device, wherein the prover device and the verifier device communicate with each other in an asymmetric manner, the method comprising the steps of: collecting, by the verifier device, first information about the prover device; selecting, by the verifier device, an authentication protocol between the verifier device and the prover device based on the collected first information; generating, by the verifier device, an authentication request message based on the selected prover-specific authentication protocol; sending, by the verifier device, the generated authentication request message to the prover device; computing, by the prover device, an authentication response message according to the selected authentication protocol based on the received authentication request message; sending, by the prover device, the authentication response message to the verifier device; verifying, by the verifier device, the received authentication response; and providing, by the verifier device, a result information based on the verified authentication response.

Description

Technical Field

[0001] The present invention relates to a computer-implemented method for performing remote authentication communication between a verifier device and a prover device. Background Technology

[0002] Remote authentication involves an interactive cryptographic protocol between two entities: a validator device and a prover device, to authenticate the prover device's integrity. During its authentication request, the validator device provides the prover device with a random number of sufficient entropy. Using this random number, the prover device constructs a response that includes a description of its current state, a log of how it reached that state, and a cryptographic proof (using this random number) guaranteeing its integrity, authenticity, and timeliness.

[0003] Since the authentication protocol is typically executed via a capable communication channel (e.g., Ethernet, cellular network, or Wi-Fi), no special measures are taken to reduce the amount of data sent.

[0004] The transmitted data includes the transmission of high-entropy random numbers (i.e., random and extremely unlikely to be reused) from the validator device to the prover device, as well as the transmission of measurement logs from the prover device to the validator device.

[0005] Therefore, certification is often impossible for devices that do not provide a capable communication channel. This includes devices that are intentionally air-gap isolated for security reasons, devices that are not designed to be connected to a larger communication infrastructure, or devices that do not have the necessary communication hardware (e.g., conventional or low-cost devices).

[0006] Therefore, these problems need to be addressed. Summary of the Invention

[0007] Therefore, it is advantageous to provide a concept for improved remote authentication communication between verifier devices and prover devices.

[0008] The object of the invention is achieved by the subject matter of the independent claims, wherein further embodiments are incorporated in the dependent claims.

[0009] In a first aspect of the invention, a computer-implemented method is provided for performing remote authentication communication between a verifier device and a prover device, wherein the prover device and the verifier device communicate with each other in an asymmetric manner, the method comprising the following steps: — The verifier device collects the first information about the prover device; — The validator device selects the authentication protocol between the validator device and the prover device based on the first information collected; — The validator device generates the authentication request message based on the selected validator-specific authentication protocol; — The validator device sends the generated authentication request message to the prover device; — The certifier device calculates the authentication response message based on the received authentication request message and the selected authentication protocol; — The certifier device sends the authentication response message to the verifier device; — The authentication response received is verified by the validator device; and

[0010] — The verifier device provides the result information based on the authentication response of the verification.

[0011] In other words, a key aspect of the invention is that authentication is performed over extremely limited communication channels, such as recording of LEDs and speakers using the smartphone camera / microphone of the verifier device, and manual input using limited control of an industrial HMI (i.e., a very limited set of buttons on the verifier device). This enables the authentication of devices that are air-gap isolated (i.e., not connected for communication or not designed for communication for security reasons).

[0012] Furthermore, this invention allows for the efficient adjustment of the authentication protocol and its execution over asymmetric and restricted communication channels.

[0013] Furthermore, this invention allows for the use of low-entropy random numbers and compressed authentication reports. This enables authentication over very slow channels (e.g., through the creative use of physical interfaces for manual input).

[0014] Therefore, this invention enables authentication between a verifier device and a prover device, where the verifier device uses a different communication channel to communicate with the prover device when inputting information, and another communication channel when receiving information. The communication channels or capabilities that a prover device can provide are typically limited compared to those of the verifier device. However, this invention enables authentication between two devices using different communication channels and / or having different communication capabilities.

[0015] This can be achieved through the following technical aspects, which are possible parts of the technical solution of the present invention:

[0016] This invention uses a strictly limited communication channel to perform remote authentication for devices that are disconnected (air gap isolation) or do not have modern communication capabilities (traditional devices).

[0017] To achieve this, the present invention relaxes the security attributes of the authentication protocol (e.g., random number length) and creatively uses the hardware of disconnected or conventional devices to establish a communication channel with sufficient capacity to execute the modified authentication protocol.

[0018] It also considers that restricted communication channels are asymmetric in terms of capacity: while communication from a restricted prover to a less restricted verifier (e.g., a smartphone) can utilize the verifier's capabilities, other methods remain severely limited by the prover's capabilities. By using this space-efficient authentication protocol, remote authentication in a favorable manner is possible for these types of devices. Furthermore, this invention enables easy authentication for corresponding (traditional) devices via software upgrades.

[0019] According to the example, communication between the prover device and the verifier device in an asymmetric manner is represented as follows: the verifier device is configured to communicate with the prover device in a first communication mode, and the prover device is configured to communicate with the verifier device in a second communication mode, wherein the first communication mode and the second communication mode are different, and / or the prover device and the verifier device are configured to communicate with each other by using different or heterogeneous communication technologies. In this way, improved and efficient authentication between the verifier device and the prover device is ensured.

[0020] According to the example, the steps for collecting the first information include at least one of the following: accessing a database, scanning a QR code-based information tag at the prover's device, or manually entering information into the verifier's device. In this way, prover-adaptive or prover-specific authentication is ensured.

[0021] According to the example, the first piece of information includes at least one of the following: the type information of the prover's device, and the communication capabilities of the prover's device. In this way, prover-compatible or prover-specific authentication is ensured.

[0022] According to the example, the authentication protocol specification includes at least one of the following prover-specific characteristics: a definition of random number information; and the selection or prioritization of at least one communication channel based on communication capabilities, communication methods, and communication speed. In this way, improved and efficient authentication between the verifier and prover devices is ensured.

[0023] According to the example, the step of selecting a prover-specific authentication protocol includes: dynamically adjusting the authentication protocol based on the device-specific communication capabilities of the chosen prover and / or verifier devices to efficiently transfer data between the verifier and prover devices. This ensures improved and efficient authentication between the verifier and prover devices.

[0024] As illustrated in the example, the selected device-specific communication method includes choosing at least one common communication method between the verifier device and the prover device. This approach ensures improved and efficient authentication between the verifier and prover devices.

[0025] As an example, the verifier device's selection of a prover-specific authentication protocol is based on an adapted variant of the authentication protocol, which the prover device can process based on its communication capabilities. This ensures improved and efficient authentication between the verifier and prover devices.

[0026] As shown in the example, the authentication request message includes at least the prover-specific random number information. This ensures improved and efficient authentication between the verifier and prover devices.

[0027] According to the example, the step of sending the computed authentication response from the prover device to the verifier device is performed on a communication channel that is the same as or different from the communication channel on which the prover device receives authentication request messages sent by the verifier device. In this way, improved and efficient authentication between the verifier device and the prover device is ensured.

[0028] In the example, verifier device 1 is a computer-based device, and prover device 2 is a technical component of the technical system. This approach increases the flexibility of authentication between verifier and prover devices.

[0029] In a second aspect of the invention, a data processing apparatus is provided, the apparatus including means for performing the method described in any of the foregoing examples.

[0030] In a third aspect of the invention, a computer program is provided, including instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of the foregoing examples.

[0031] In a fourth aspect of the invention, a computer-readable medium is provided, comprising instructions that, when executed by a computer, cause the computer to perform the method according to any one of the foregoing examples. Attached Figure Description

[0032] Exemplary embodiments will now be described with reference to the following figures:

[0033] Figure 1 The illustration depicts a schematic computer-implemented method for performing remote authentication communication between a verifier device and a prover device according to an embodiment of the present invention. Detailed Implementation

[0035] Figure 1 The illustration depicts a schematic computer-implemented method 100 for performing remote authentication communication between verifier device 1 and prover device 2, wherein prover device 2 and verifier device 1 communicate with each other in an asymmetric manner. The method includes the following steps:

[0036] In the first step 102, the verifier device 1 collects first information 3 about the prover device 2.

[0037] Optionally, the first information 3 includes at least one of the following: type information of the prover device 2, and communication capabilities of the prover device 2.

[0038] Optionally, step 102 of collecting the first information 3 includes at least one of the following: accessing a database, scanning a QR code-based information tag at the verifier device 2, or manually entering information into the verifier device 1.

[0039] In the second step 104, the verifier device 1 selects the authentication protocol 4 between the verifier device 1 and the prover device 2 based on the first information 3 collected.

[0040] Optionally, step 104 of selecting a prover-specific authentication protocol 4 includes: dynamically adjusting the authentication protocol 4 based on the device-specific communication capabilities of the prover device 2 and / or verifier device 1 to efficiently transmit data between verifier device 1 and prover device 2.

[0041] In the third step 106, the verifier device 1 generates an authentication request message 5 based on the selected verifier-specific authentication protocol 4.

[0042] In step 4, 108, the verifier device 1 sends the generated authentication request message 5 to the prover device 2.

[0043] In step 510, the certifier device 2 calculates the authentication response message 6 based on the received authentication request message 5 and the selected proof protocol 4.

[0044] In step 612, the certifier device 2 sends the authentication response message 6 to the verifier device 1.

[0045] Optionally, step 112, which sends the calculated authentication response 6 from the prover device 2 to the verifier device 1, is performed on the same or different communication channel as the communication channel on which the prover device 2 receives the authentication request message 5 sent by the verifier device 1.

[0046] In step 7, 114, the received authentication response 6 is verified by verifier device 1.

[0047] In step 8, 116, the verifier device 1 provides result information based on the verified authentication response message 6.

[0048] Optionally, the communication between prover device 2 and verifier device 1 is represented in an asymmetric manner: verifier device 1 is configured to communicate with prover device 2 in a first communication mode, while prover device 2 is configured to communicate with verifier device 1 in a second communication mode, wherein the first communication mode and the second communication mode are different, and / or prover device 2 and verifier device 1 are configured to communicate with each other by using different or heterogeneous communication technologies.

[0049] To explain how to understand the first communication method of verifier device 1 and the second communication method of verifier device 2 according to the present invention, the following example is provided:

[0050] The validator device may be a smartphone or a portable computer device, which may have one of the following: such as a camera, microphone, and / or virtual keyboard for users to input information into the computer device in at least one manner. The validator device may only have a simple keyboard for users to input information and / or commands and / or a display (e.g., LED, LCD, or other suitable type of display) for outputting information in a defined manner.

[0051] Therefore, it is clear from the example that when the first communication method differs from the second communication method and / or the prover device 2 and the verifier device 1 are configured to communicate with each other using different or heterogeneous communication technologies, this means:

[0052] After receiving technical input information or commands via a keyboard or other technology provided by the verifier device 2, which tells the verifier device 2 what information it should output, the verifier device 2 outputs relevant information to the verifier device 1 by signaling the relevant processed information via an LED or LCD device that can have a display (= the first communication channel of the verifier device 2). The verifier device 2 receives the output information by using a camera or other means that can interpret and process the LED or LCD signals output by the verifier device 2 (= the second communication channel of the verifier device 1 may be different from the first communication channel and use a different or heterogeneous communication technology than the verifier device 2).

[0053] Furthermore, the present invention allows entropy-reduced random numbers to be input into the certifier device (= certifier device 2) via, for example, using a button, HMI input (e.g., 3 seconds), or an LED used as a sensor.

[0054] Optionally, the specification of Authentication Protocol 4 includes at least one of the following prover-specific characteristics: a definition of random number information, wherein the definition of random number information may include, for example, length information of the random number, the possibility of encoding the random number; and selection or prioritization of at least one communication channel based on communication capability, communication method, and communication speed.

[0055] Optionally, the selected device-specific communication method includes the selection of at least one common communication method between the prover device 2 and the verifier device 1.

[0056] Optionally, the verifier device 1 selects the prover-specific authentication protocol 4 based on an adapted authentication protocol variant, which the prover device 2 is able to process based on its communication capabilities.

[0057] Optionally, the authentication request message 5 includes at least the certifier-specific random number information.

[0058] Alternatively, verifier device 1 is a computer-based device, such as a portable computing device like a smartphone, while verifier device 2 is a technical component of a technical system, such as an industrial embedded device or a field device of a sensor device such as a temperature sensor.

[0059] Further aspects of the invention will be presented below in the form of another example:

[0060] An exemplary implementation of the authentication protocol could be as follows, in which an engineer is authenticating a device that lacks modern communication features (i.e., only a few user input buttons and an LCD multi-segment display).

[0061] The engineer physically brings the smartphone (= Authenticator Device 1) close to the device and initiates the authentication process within the app. The app retrieves necessary information about Authenticator Device 2 (e.g., communication technology, authentication protocol, whitelist, etc.) from a backend service (such as a database) to perform authentication via Wi-Fi or a cellular network. The information from the backend service includes a detailed description of the procedure suitable for the device (e.g., random number length, transmission method and speed, encoding, and the complete specification of the authentication protocol).

[0062] The engineer is then instructed from the app to initiate authentication mode on the prover device by navigating the HMI. When authentication mode is initiated, the prover device expects a series of key presses, which will generate the random number required by the authentication protocol. Since the prover device has a limited number of physical keys, (in this example) 12 key presses are required to generate a random number with sufficient entropy. The engineer is then instructed from the app to press the corresponding button on the prover device's HMI.

[0063] The verifier device then calculates the authentication response and encodes that information onto its LCD or LED display in a rapid, continuous update. An engineer points the verifier device's smartphone camera at the verifier device's LCD display, and the verifier device's app records the rapidly flashing information for decoding.

[0064] Then, the verifier's device app notifies the engineer or user that authentication was successful. Afterward, the engineer confirms the transmission to the verifier's device by pressing a button. The verifier's device then stops transmitting information and resumes normal operation. The smartphone app can then transmit the received and processed information to the backend service.

[0065] In this example, the prover device does not have any advanced features, so the method can be implemented on a wide variety of existing devices with limited communication capabilities.

[0066] If more advanced features are available, data transmission could be made easier for engineers; for example, if the verifier device is able to sense sound or light signals, random numbers could be transmitted via other or more communication channels, such as sound or light.

[0068] Reference number

[0069] 1. Verifier Equipment

[0070] 2. Witness Equipment

[0071] 3 First Information

[0072] 4. Authentication Protocol

[0073] 5. Authentication Request Message

[0074] 6. Authentication Response Message

[0075] 7 Results Information

[0077] 100 Computer-based implementation methods

[0078] 102 Collections

[0079] 104 choices

[0080] 106 generated

[0081] 108 sent

[0082] 110 Calculation

[0083] 112 sent

[0084] 114 Verification

[0085] 116 provides

Claims

1. A computer-implemented method (100) for performing remote authentication communication between a verifier device (1) and a prover device (2), wherein the prover device (2) and the verifier device (1) communicate with each other in an asymmetric manner, the method comprising the steps of: — First information (3) about the prover device (2) is collected (102) by the verifier device (1); — The verifier device (1) selects (104) the authentication protocol (4) between the verifier device (1) and the prover device (2) based on the first information (3) collected; — The verifier device (1) generates (106) an authentication request message (5) based on the selected verifier-specific authentication protocol (4); — The verifier device (1) sends (108) the generated authentication request message (5) to the prover device (2); — The certifier device (2) calculates (110) an authentication response message (6) based on the received authentication request message (5) and the selected authentication protocol (4); — The certifier device (2) sends the authentication response message (6) (112) to the verifier device (1); — The authentication response (6) received by the verifier device (114) is verified; and — The verifier device (1) provides (116) result information (7) based on the verified authentication response (6).

2. The computer-implemented method (100) according to claim 1, wherein the communication between the prover device (2) and the verifier device (1) in an asymmetric manner represents: the verifier device (1) being configured to communicate with the prover device (2) in a first communication mode, and the prover device (2) being configured to communicate with the verifier device (1) in a second communication mode, wherein the first communication mode is different from the second communication mode, and / or the prover device (2) and the verifier device (1) being configured to communicate with each other by using different or heterogeneous communication technologies.

3. The computer-implemented method (100) according to any one of the preceding claims, wherein the step (102) of collecting the first information (3) includes at least one of the following: accessing a database, scanning a QR code-based information tag at the verifier device (2), and manually inputting information into the verifier device (1).

4. The computer-implemented method (100) according to any one of the preceding claims, wherein the first information (3) includes at least one of the following: type information of the prover device (2), and communication capabilities of the prover device (2).

5. The computer-implemented method (100) according to any one of the preceding claims, wherein the specification of the authentication protocol (4) includes at least one of the following prover-specific characteristics: definition of random number information; selection or prioritization of at least one communication channel based on communication capability, communication method and communication speed.

6. The computer-implemented method (100) according to any one of the preceding claims, wherein the step (104) of selecting the certifier-specific authentication protocol (4) comprises: The authentication protocol (4) is dynamically adjusted based on the device-specific communication capabilities of the verifier device (2) and / or the validator device (1) to efficiently transmit data between the validator device (1) and the verifier device (2).

7. The computer-implemented method (100) according to claim 5, wherein the selected device-specific communication method includes: The selection of at least one common communication method between the prover device (2) and the verifier device (1).

8. The computer-implemented method (100) of claim 5, wherein the selection of the prover-specific authentication protocol (4) by the verifier device (1) is based on an adjusted authentication protocol variant, wherein the prover device (2) is capable of processing the adjusted authentication protocol variant based on the communication capabilities of the prover device (2).

9. The computer-implemented method (100) according to any one of the preceding claims, wherein the authentication request message (5) includes at least provider-specific random number information.

10. The computer-implemented method (100) according to any one of the preceding claims, wherein the step (112) of sending the calculated authentication response (6) from the prover device (2) to the verifier device (1) is performed on the same or different communication channel on which the prover device (2) receives the authentication request message (5) sent by the verifier device (1).

11. The computer-implemented method (100) according to any one of the preceding claims, wherein the verifier device (1) is a computer-based device, and the verifier device (2) is a technical component of a technical system.

12. A data processing apparatus comprising means for performing the method according to any one of claims 1 to 11.

13. A computer program comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 11.

14. A computer-readable medium comprising instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 11.

Images