Authentication System Domain Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems require complex processes for nodes to change services, as they need to select and switch secret keys and authenticating means for each desired service, making it cumbersome for users to obtain session keys for secure communication.
Innovation Solution
An authentication system with a user node, service nodes, an authentication database, and a key distribution unit that allows users to request domain changes, obtaining the necessary secret keys and session keys for secure communication between nodes within the desired domain, enabling easy service changes and secure encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple secret keys are provided for different domains to enable service changes, then adaptability is improved, but device complexity increases due to multiple authenticating means and key management requirements
Solution Approach 1:
The patent introduces a domain management table and domain determination unit as intermediary structures between the user node and multiple authenticating means. This intermediary automatically determines the appropriate domain based on service type and selects the corresponding secret key, eliminating the need for users to manually manage multiple keys and authenticating means while maintaining adaptability across different service domains
2Reliability
If manual selection of secret keys and authenticating means is required for service changes, then security is maintained through controlled access, but ease of operation deteriorates due to cumbersome key management processes
Solution Approach 1:
The patent implements a self-service mechanism where the domain determination unit automatically performs domain identification and secret key selection based on the service type. The system autonomously manages the authentication process by querying the domain management table and obtaining appropriate credentials without user intervention, thereby maintaining security through controlled access while dramatically simplifying the service change process for users
3Ease of operation
If a single secret key is recorded in the authenticating means for each node, then ease of operation is improved, but adaptability deteriorates as only one domain can be formed
Solution Approach 1:
The patent segments the authentication system into multiple independent components: multiple secret keys are stored in the authentication database organized by domain, and a domain management table maps service types to corresponding domains. This segmentation allows the system to maintain simplicity in key management (the authenticating means still operates with a single active key at a time) while achieving high adaptability through the ability to switch between multiple domain-specific keys based on service requirements
Data Source
AI summary
The authentication system includes a user node, a plurality of service nodes, an authentication database storage unit, an authentication unit, a user information database storage unit, and a key distribution unit. Each service node is configured to provide a service corresponding to its domain. The authentication database storage unit is configured to store a secret key of the user node for each domain. The user information database storage unit is configured to store an account used for associating a domain with the user node. The key distribution unit is configured to, upon receiving a domain change request from the user node and then confirming that the user information database stores the account associating the user node with a desired domain to which the user node intends to belong, obtain the secret key of the user node associated with the desired domain from the authentication database storage unit, and send the obtained secret key to the user node. The authentication unit is configured to create a session key, and encrypt the created session key with the secret key corresponding to the desired domain, and send the encrypted session key to the user node.