Challenge-Response Authentication with Dynamic Response Key Selection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing device authentication methods using challenge & response techniques lack flexibility and security, particularly in preventing falsification of encrypted data and determining the appropriate encrypted data to use.

Innovation Solution

A system and method that involves a server and client using a challenge & response method, where the server and client perform distinct operations, including generating and verifying response keys using multiple stages of key derivation functions (KDFs) and cryptographic calculations, with parameter data and encrypted data being signed or unsigned to enhance security and flexibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a single fixed response key is used in challenge & response authentication, then the authentication process is simple and fast, but the system lacks flexibility and security against key compromise

Engineering Contradiction:

Improveauthentication securityVSAvoidresponse key management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements dynamic response key generation by deriving multiple response keys from a single master key using key derivation functions. The server selects different response keys from a set of pre-generated keys based on challenge data, making the authentication system adaptive and flexible rather than static. This resolves the contradiction by providing multiple keys without requiring multiple master keys, maintaining simplicity while enhancing security.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the parameter of response key selection based on challenge data characteristics. The server determines which response key to use by analyzing the challenge data, effectively varying the key parameter dynamically. This allows the system to maintain a single master key while generating multiple response keys through parameter transformation, resolving the security-simplicity contradiction.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If multiple encrypted data with different response keys are stored, then flexibility and security are improved, but the complexity of selecting and managing encrypted data increases

Engineering Contradiction:

Improveencrypted data selection flexibilityVSAvoidencrypted data management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The server performs preliminary action by pre-generating multiple response keys and encrypting corresponding data before actual authentication occurs. These pre-prepared encrypted data are stored and associated with challenge data characteristics. During authentication, the server simply selects the appropriate pre-generated encrypted data based on the incoming challenge, avoiding complex real-time encryption operations while maintaining flexibility.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces challenge data as an intermediary that links the master key to specific response keys and encrypted data. The challenge data acts as a mediator that determines which pre-generated encrypted data should be used, simplifying the selection process. Instead of managing multiple independent key-data pairs, the system uses challenge data as a reference to select from pre-generated options, reducing management complexity while maintaining adaptability.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If signature verification is performed on all data, then data falsification is prevented, but the authentication process time increases

Engineering Contradiction:

Improvedata authenticityVSAvoidauthentication process time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system applies partial action by performing signature verification selectively rather than on all data. The server verifies signatures on challenge data and parameter data that are critical for authentication, while using pre-generated encrypted data that may not require re-verification. This selective approach maintains data authenticity for essential components while reducing overall verification time compared to verifying every piece of data.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20260081896A1Information processing system, one or more non-transitory computer-readable storage media having program stored therein, and authentication method

Publication Date: 2026.03.19 NINTENDO CO LTD

AI summary

A server issues challenge data and transmits the challenge data to a client. The client stores encrypted group data including a plurality of encrypted data encrypted with a server key, and parameter data A, in a memory, receives the challenge data, generates response data using a response key on the client side, and transmits the response data, the encrypted group data, and the parameter data A to the server. The server selects encrypted data to be used from the received encrypted group data, based on the received parameter data A, sets a response key on the server side, based on the selected encrypted data and data decrypted with the server key, verifies the received response data, based on the challenge data and the response key on the server side, and notifies a result of the verification to the client. The client receives the notification.