Card Credential Generation for Secure Access Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure access systems using smart cards face challenges in maintaining cryptographic security without incurring excessive processing costs, as malicious parties can potentially deduce internal keys or break cryptographic features, allowing unauthorized access.
Innovation Solution
A method that generates a card credential by encrypting a card key using a server encryption key, enabling challenge-response interactions, and using linked cryptographic protocols on access cards and secure servers to authenticate access requests, allowing for stateless security without relying on centralized access control lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If smart cards with built-in processors and memory are used to store cryptographic keys, then security against password reproduction is improved, but processing power requirements and system complexity increase
Solution Approach 1:
The system divides security functionality into two segments: the access card contains only cryptographic keys and basic challenge-response capability, while the server performs sophisticated cryptographic verification. This segmentation allows the card to remain simple and low-cost while the server handles complex security processing.
Solution Approach 2:
The patent introduces a credential structure as an intermediary that contains encrypted representations of cryptographic keys. This credential acts as a mediator between the simple card and the server, enabling secure key distribution and verification without requiring complex processing in the card itself.
2Reliability
If sophisticated challenge-response calculations are performed by the smart card to prevent key deduction attacks, then cryptographic security is improved, but processing power requirements and cost increase
Solution Approach 1:
The patent extracts the computationally intensive cryptographic verification operations from the access card and relocates them to the server. The card retains only minimal processing capability for generating challenge-response pairs, while the server performs the sophisticated mathematical operations needed to verify credentials and prevent key deduction attacks.
Solution Approach 2:
The credential structure serves as an intermediary that enables secure cryptographic verification without requiring the card to perform complex calculations. The credential contains pre-computed cryptographic data that the server can verify using standard cryptographic protocols, reducing the processing burden on the card.
3Ease of operation
If centralized access control lists are used for authentication, then access management is simplified, but system vulnerability to attacks increases
Solution Approach 1:
The patent extracts the authentication logic from centralized access control lists and distributes it to individual users through credentials stored on their access cards. Each user's credential contains their own cryptographic verification data, eliminating the single point of failure represented by centralized access control lists while maintaining simplified access management through the credential structure.
Data Source
AI summary
In one implementation, a method for providing access to a secure facility includes authenticating the user; generating a card credential, transmitting the card credential to an access card carried by of the user, and transmitting the card key to the access card in a form that is usable by the access card. The generating the card credential includes encrypting the card key using a server encryption key. The card key is usable for a challenge-response interaction during subsequent access requests by the user.