Android Application Authentication via Kernel Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating Android applications are costly and insecure, particularly due to the need for managing private keys and the intervention of Certificate Authorities, which complicates the authentication process between applications.
Innovation Solution
A method and apparatus that utilize an authentication server to authenticate applications by requesting and verifying authentication information signed with the server's private key, comparing HMAC values, and ensuring the integrity of execution files, thereby reducing costs and enhancing security without direct management of private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate authentication through CA is used, then authentication security is improved, but costs increase due to CA intervention
Solution Approach 1:
The patent extracts the authentication verification function from the CA system and implements it within the Android operating system itself. The kernel generates and manages authentication keys and certificates natively, eliminating the need for external CA intervention while maintaining security standards. This reduces authentication costs by removing the CA fee structure.
Solution Approach 2:
The Android kernel acts as an intermediary between applications, providing a centralized authentication service. Instead of applications directly managing their own keys or relying on external CAs, the kernel mediates the authentication process by verifying certificates and managing key pairs, thereby reducing costs while maintaining security.
2Reliability
If public key exchange method is used, then authentication capability is improved, but key management complexity increases
Solution Approach 1:
The system implements self-service authentication where the Android kernel automatically generates key pairs and manages certificate storage. Applications don't need to manually manage their own private keys; instead, the kernel handles key generation, storage, and verification automatically. This reduces key management complexity while maintaining public key authentication capabilities.
Solution Approach 2:
The Android kernel provides a universal authentication service that handles public key exchange and certificate verification for all applications. Instead of each application implementing its own key management logic, the kernel provides a multi-functional authentication framework that serves all applications, thereby reducing overall system complexity.
3Adaptability or versatility
If applications manage their own private keys, then authentication independence is improved, but security maintenance becomes difficult
Solution Approach 1:
The Android kernel serves as an intermediary that manages private keys on behalf of applications. While applications maintain authentication independence through their own certificate identities, the kernel securely manages the underlying private keys, preventing direct exposure and improving security maintenance. This mediator approach allows applications to be independent in identity while relying on the kernel for secure key management.
Solution Approach 2:
The patent extracts the sensitive private key management function from applications and places it in the kernel. Applications no longer directly handle private keys; instead, they interact with the kernel's authentication interface. This extraction improves security maintenance by isolating key management to a protected environment while preserving application authentication independence.
Data Source
AI summary
A method performed by a first application in a client apparatus to authenticate a second application in the client apparatus is provided. The method includes, when the first application receives an execution request from the second application, requesting authentication information of the second application from an authentication server, obtaining the authentication information of the second application from the authentication server, and authenticating the second application using the authentication information, wherein the authentication information of the second application is signed with a private key of the authentication server.