Asymmetric Session Credentials for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing session credential systems using symmetric keys are vulnerable to unauthorized access as services can decrypt and misuse the secret key, compromising security and integrity.
Innovation Solution
Implementing asymmetric session credentials, where session tokens are encrypted with a session encryption key, providing a secure mechanism for authentication without exposing the session key, and allowing secure access across regions with controlled key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric session credentials are used for authentication, then authentication functionality is provided, but services can decrypt and misuse the secret key compromising security
Solution Approach 1:
The patent applies asymmetry by transitioning from symmetric key cryptography to asymmetric key cryptography for session credentials. The session credential includes a public key that can be freely shared and a private key that remains secret. Services can verify signatures using the public key without being able to derive the private key, thus preventing unauthorized access while maintaining authentication functionality.
Solution Approach 2:
The patent introduces an asymmetric key pair as an intermediary mechanism between the service and the secret key. The public key acts as a mediator that allows verification of authentication without exposing the private key. This intermediary layer prevents services from directly accessing or misusing the secret key while still enabling authentication verification.
2Reliability
If services can decrypt session credentials to verify requests, then request verification is enabled, but services may generate unauthorized requests using the extracted secret key
Solution Approach 1:
The patent uses asymmetric cryptography where the session credential contains a public key for verification and a private key for signing. Services can verify requests by checking signatures with the public key, but cannot generate unauthorized requests because they lack the private key. This asymmetric separation of verification and signing capabilities prevents unauthorized request generation.
Solution Approach 2:
The patent extracts the verification capability from the secret key by using public key infrastructure. The public key is extracted and embedded in the session credential, allowing verification without exposing the private key. This extraction separates the harmful capability (unauthorized request generation) from the useful capability (request verification).
Data Source
AI summary
Techniques for using short-term credentials using asymmetric session keys are described herein. A request for a short-term credential is received that is digitally signed with a different credential. In response to the request, short-term credential data is generated and populated with a public session key corresponding to a private session key. The short-term credential data is then encrypted with a session encryption key to produce the short-term credential token, which can then be used by the requester as a short-term credential for subsequent requests.