Challenge-Response Authentication with Split Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device authentication methods using challenge & response techniques lack flexibility and security, particularly when seed data is confidential, leading to potential data leakage risks and increased processing load on servers.
Innovation Solution
A device authentication system where the client generates response data using a response key, which is set on the server side using parameters transmitted from the client, allowing for secure and efficient verification without requiring the server to perform all calculations, and utilizing multiple KDF stages with different parameters for each client.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server performs all calculations for setting the response key, then authentication security is improved, but server processing load increases
Solution Approach 1:
The response key setting calculation is divided into two parts: the client performs the first calculation using its stored seed data and transmits the result to the server, while the server performs only the second calculation using additional seed data. This segmentation reduces the server's processing load while maintaining authentication security through collaborative computation.
2Adaptability or versatility
If the server stores and processes confidential seed data, then authentication flexibility is improved, but data leakage risk increases
Solution Approach 1:
The confidential seed data is extracted from the server and stored in the client instead. The client uses its stored seed data to perform the first calculation and transmits only the calculation result to the server. This extraction eliminates the need for the server to store and process confidential seed data, thereby reducing data leakage risk while maintaining authentication flexibility.
3Reliability
If the client transmits parameters to the server for response key setting, then authentication security is improved, but communication data volume increases
Solution Approach 1:
Instead of transmitting the actual confidential seed data from the client to the server, the client transmits a calculation result (copy of processed data) that was derived from its stored seed data. This copying approach allows the server to verify authentication security without receiving the original confidential seed data, thereby minimizing communication data volume.
Data Source
AI summary
A server issues challenge data and transmits the challenge data to a client. The client stores a first parameter, receives the challenge data, generates response data from the challenge data using a response key on the client side, and transmits the response data and the first parameter to the server. The server further receives the response data and the first parameter, specifies seed data for calculation for setting a response key on the server side, using the first parameter, sets the response key on the server side by executing the calculation using the seed data, verifies the response data using the challenge data and the response key on the server side, and notifies a result thereof. The client receives the result.