Authentication Unit Segmentation for Secure Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing authentication processes in communication technologies are vulnerable to attacks and cracking, as they directly authenticate the permission of accessing devices within a service unit, leading to potential data leakage and security breaches.
Innovation Solution
An authentication method and apparatus that isolates the authentication operation within a dedicated authentication unit, using a service unit to manage and transmit seeds and keys, ensuring that authentication-related information is stored and processed securely, separate from service information, thereby enhancing security by preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authentication is performed in a service unit, then authentication functionality is integrated with service operations, but security is compromised because key information can be accessed by service information
Solution Approach 1:
The system is divided into two separate units: a service unit for handling service operations and an authentication unit for performing authentication. This segmentation isolates key information in the authentication unit from service information in the service unit, preventing unauthorized access while maintaining both authentication and service functionalities.
Solution Approach 2:
The authentication functionality is extracted from the service unit and placed into a dedicated authentication unit. This extraction removes the security vulnerability where service information could access key information, while preserving the authentication capability as a separate, secure component.
2Ease of operation
If key information is stored in the service unit, then authentication can be performed using service information, but data leakage occurs because service information can access key information
Solution Approach 1:
Key information is extracted from the service unit and stored exclusively in the authentication unit. This extraction prevents service information from accessing key information, eliminating the data leakage vulnerability while maintaining authentication operations through dedicated authentication unit handling.
Solution Approach 2:
The authentication unit acts as an intermediary between service information and key information. Service information can request authentication services, but the authentication unit mediates access to key information, ensuring that service information never directly accesses sensitive key data.
3Device complexity
If authentication and service operations are combined in one unit, then system complexity is reduced, but security is weakened because unauthorized users can attack the authentication process through service information
Solution Approach 1:
The system is segmented into a service unit and an authentication unit, each with dedicated responsibilities. This segmentation increases structural complexity but provides security isolation, preventing unauthorized users from attacking authentication through service information channels.
Solution Approach 2:
Authentication operations are extracted into a separate authentication unit, creating a security boundary that protects key information from service information attacks. This extraction justifies the increased complexity by providing necessary security protection.
Data Source
AI summary
This application provides example authentication methods and apparatuses. One example authentication method is used for a terminal device. The method includes receiving, by the first service unit, a first request from a second device, wherein the first request is used to request a first seed. The first service unit sends the first request to the first authentication unit. The first authentication unit sends a first response to the first service unit, wherein the first response comprises the first seed. The first service unit sends the first response to the second device. The first service unit receives a second seed from the second device. The first service unit sends the second seed to the first authentication unit. The first authentication unit determines a third seed based on a first key and the second seed, wherein the first key is determined based on the first seed.