Building Access Reader Authentication With Ephemeral Session Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are unable to verify the authenticity of wireless terminal devices before providing digital access information, as rogue readers or malicious devices can mimic legitimate ones, potentially gaining unauthorized access to personal information and physical security.
Innovation Solution
A mobile device authenticates a reader device using a wireless protocol (NFC or Bluetooth) with a static reader public key, generating a session key through ephemeral key pairs to encrypt and verify credentials, ensuring secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If digital access information is provided to third-party wireless terminal devices, then access convenience is improved, but security against rogue readers deteriorates
Solution Approach 1:
The system performs preliminary authentication of the reader device by the mobile device before providing digital access information. The mobile device verifies the reader's identity and authorization status in advance, ensuring that credentials are only transmitted to legitimate readers. This preliminary security check prevents rogue readers from obtaining access credentials while maintaining the convenience of digital access.
2Reliability
If authentication protocols are implemented between mobile device and reader device, then security is improved, but device complexity increases
Solution Approach 1:
The system introduces a provisioning device as an intermediary that pre-establishes cryptographic relationships between mobile devices and reader devices. The provisioning device distributes public keys and authentication credentials in advance, allowing the mobile device and reader device to authenticate each other using pre-configured keys without requiring complex real-time key exchange protocols. This intermediary approach simplifies the authentication process while maintaining high security standards.
Data Source
AI summary
The techniques described herein provide for authentication of a reader device over a wireless protocol (e.g., NFC or Bluetooth, BLE). The mobile device can receive and store the static public key of the reader device and one or more credentials, each credential specifying access to an electronic lock. The mobile device can receive an ephemeral reader public key, a reader identifier, and a transaction identifier. The mobile device can generate session key using the ephemeral mobile private key and the ephemeral reader public key and send the ephemeral mobile public key to the reader device. The reader device can receive the ephemeral mobile public key and sign and transmit a signature message to the mobile device. The mobile device can validate a reader signature and generate an encrypted credential that the reader can use to access an electronic lock. The reader device can authenticate the mobile device for mutual authentication.