Mutual Authentication Protocol Asymmetry Reflection Attack
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content protection protocols, such as CPRM, are vulnerable to security attacks where a rogue storage device poses as an authorized device by setting its authentication challenges equal to the first challenge, leading to unauthorized content distribution.
Innovation Solution
Implementing an enhanced mutual authentication and key exchange protocol where the content accessing device verifies that the second authentication challenge is different from the first, and generates responses using distinct response generation functions to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the authentication protocol uses the same challenge value for both challenges, then the protocol is simpler to implement, but security is compromised allowing rogue devices to authenticate
Solution Approach 1:
The patent applies asymmetry by ensuring that the first and second authentication challenges are different values. This prevents the reflection attack where a rogue device would set both challenges to the same value and use the response from one challenge to authenticate against the other. The asymmetry in challenge values breaks the symmetry required for the attack to succeed.
Solution Approach 2:
The patent implements preliminary action by having the accessing device verify that the second challenge received from the storage device is different from the first challenge it sent, before proceeding with authentication. This preliminary check prevents the authentication process from continuing under compromised conditions where challenges might be identical.
2Productivity
If the accessing device sends a response to the second challenge, then mutual authentication can be completed, but vulnerability to reflection attacks increases
Solution Approach 1:
The patent converts the potential harm of response interception into a benefit by using the response verification mechanism to detect authentication attempts. When the accessing device receives a response to the second challenge, it verifies this response against what it expects based on the challenge-response relationship. This verification process, originally designed for authentication completion, now also serves to detect and prevent reflection attacks.
Solution Approach 2:
The patent uses asymmetry in the challenge-response relationship where the first challenge and second challenge are different values. This ensures that a response generated for the second challenge cannot be validly used to authenticate against the first challenge, preventing the reflection attack even if the response is intercepted and replayed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One feature pertains to a content accessing device for securing content. The content accessing device is provisioned with a cryptographic algorithm, and generates a symmetric key also known to a content storage device. The content accessing device sends a first authentication challenge to the content storage device, where the first authentication challenge is based on the cryptographic algorithm and the symmetric key. The content accessing device receives a second authentication challenge from the content storage device in response to sending the first authentication challenge, and determines whether the first authentication challenge is different from the second authentication challenge. If the second authentication challenge is different from the first authentication challenge the content accessing device sends a first response to the content storage device in response to the second authentication challenge.