Authentication Server Token Generation via Relay Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems for mobile devices accessing services struggle with efficient and secure token generation and transmission, particularly in systems using relays, which can introduce latency and bandwidth issues and may not effectively separate authentication and authorization functions.
Innovation Solution
An authentication server with a processor that generates and transmits tokens based on a shared secret and reliance on a relay to ensure authorization, using a Kerberos-like protocol to securely authenticate and authorize mobile devices, thereby enabling access to services through a relay.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a relay is used to transmit authentication requests and tokens between mobile devices and servers, then security is improved by separating authentication and authorization functions, but latency increases and bandwidth usage increases
Solution Approach 1:
The authentication server generates and sends the token to the relay in advance, before the mobile device needs to access the service. This preliminary action allows the relay to have the token ready for immediate forwarding, reducing the latency that would otherwise occur during token generation and transmission.
Solution Approach 2:
The relay acts as an intermediary that receives the token from the authentication server and forwards it to the mobile device. This intermediary role allows the relay to buffer and manage token transmission efficiently, reducing the direct communication overhead between the authentication server and mobile device, thereby reducing latency.
2Reliability
If a relay is used to transmit authentication requests and tokens between mobile devices and servers, then security is improved by separating authentication and authorization functions, but bandwidth usage increases
Solution Approach 1:
The token is extracted from the authentication server and placed into the relay's buffer. This extraction allows the token to be transmitted to the mobile device through the relay without requiring continuous high-bandwidth communication between the authentication server and mobile device, thereby reducing overall bandwidth consumption.
Solution Approach 2:
The relay serves as an intermediary that efficiently manages token transmission, reducing the bandwidth burden on the authentication server and network infrastructure by handling token forwarding locally rather than requiring direct high-bandwidth communication between distant endpoints.
3Device complexity
If traditional authentication protocols are used without separating authentication and authorization functions, then system complexity is reduced, but security and authorization reliability deteriorate
Solution Approach 1:
The authentication system is segmented into distinct functions: the authentication server handles token generation based on shared secrets, while the relay handles authorization verification and forwarding. This segmentation separates authentication and authorization functions, improving authorization reliability while keeping each component relatively simple.
Solution Approach 2:
The relay acts as an intermediary that simplifies the authentication server's role by handling authorization verification and token forwarding. This allows the authentication server to focus solely on secure token generation, improving authorization reliability without significantly increasing overall system complexity.
Data Source
AI summary
An authentication server and method are provided for generating tokens for use by a mobile electronic device for accessing a service. Communications between the device and the authentication server are through a relay. A memory stores a secret shared with a service server from which the service is provided. A processor is configured to generate the token using the shared secret and based on a reliance on the relay to ensure that the device has authorization to access the service. One or more computer readable medium having computer readable instructions stored thereon that cause the device to obtain proof of authorization to access the service is also provided. The instructions implement a method comprising: outputting via a wireless connection to a relay a request addressed to an authentication server for a token and receiving the token from the authentication server via the relay.