Authentication Relay for Low-Power Device Key Agreement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication and key agreement procedures for low-computing-capability devices, such as zero-power terminals, lack clear specifications, making them unsuitable for secure communication with network sides due to high complexity and unsupportable computation requirements.
Innovation Solution
An authentication method involving a first device generating and using message authentication codes based on a key generation algorithm and parameter, with proxy nodes and authentication network elements facilitating secure communication by reducing the device's computational burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication and key agreement procedures are used, then communication security is improved, but device complexity and computational requirements increase beyond the capability of low-computing-capability devices
Solution Approach 1:
The patent introduces a network side device as an intermediary that performs complex authentication operations on behalf of the low-computing-capability first device. The network side device generates authentication parameters, computes message authentication codes, and manages the authentication protocol, allowing the first device to participate in secure authentication without bearing the computational burden.
Solution Approach 2:
The authentication procedure is segmented into distinct functional components: the first device generates or provides minimal authentication input, the network side device performs complex key derivation and message authentication code generation, and separate authentication requests and responses are exchanged. This segmentation allows computational tasks to be distributed according to device capabilities.
2Reliability
If traditional authentication procedures are implemented, then authentication security is improved, but the computational burden becomes unsupportable for zero-power terminals
Solution Approach 1:
The network side device acts as a computational intermediary that performs energy-intensive cryptographic operations including key derivation functions and message authentication code generation. The first device with limited energy resources only performs minimal computational tasks, such as providing authentication input or verifying received authentication parameters, thereby staying within its energy budget.
Solution Approach 2:
The patent replaces the mechanical/computational system where the first device performs all authentication computations with a system where computational tasks are substituted by network side processing. The first device offloads computational work to the network infrastructure, replacing local computational mechanics with remote network-based computation.
3Ease of operation
If clear authentication specifications are provided for low-computing-capability devices, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The network side device serves as an intermediary that handles protocol complexity, message formatting, and authentication parameter management. The first device follows simplified procedures where it either receives pre-computed authentication data from the network or provides minimal input, while the network side device manages the complex authentication specification requirements.
Solution Approach 2:
The network side device performs self-service by automatically generating authentication parameters, computing message authentication codes, and managing the authentication protocol flow without requiring the first device to implement complex authentication logic. This allows the first device to operate with simpler functionality while the network side device handles the computational complexity.
Data Source
AI summary
The present application provides a method and an apparatus for authentication. The method comprises: a first device receiving a first authentication request from an agent node, wherein the first authentication request comprises a first message authentication code, and the first message authentication code is generated by an authentication network element; the first device generating a second message authentication code on the basis of a first key generation algorithm and a first parameter; the first device authenticating the authentication network element on the basis of the first message authentication code and the second message authentication code; the first device generating a response parameter in the condition that the authentication network element is successfully authenticated; and the first device sending a first authentication response to the agent node, wherein the first authentication response comprises the response parameter, and the response parameter is configured for authenticating the first device.