Challenge-Response Authentication with Variable Server-Verified Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device authentication methods using a challenge & response method lack variations in response keys, making them susceptible to falsification and inefficient.
Innovation Solution
The system includes a client and server configuration that generates and verifies response keys using multiple encrypted data sets, parameter data, and signature verification to enhance security and efficiency, allowing for variations in response keys based on parameter data and server-side calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional challenge & response authentication method is used, then the authentication process is simple, but the response key lacks variations making it susceptible to falsification
Solution Approach 1:
The authentication system segments the response key generation into multiple components: challenge data from the server, parameter data from the client, and encrypted data sets. By dividing the authentication process into these independent segments that are combined during verification, the system achieves both simplicity and security without requiring complex pre-shared secrets or certificates.
Solution Approach 2:
The system performs preliminary actions by pre-generating multiple encrypted data sets on the client side before authentication. These encrypted data sets are prepared in advance and stored locally, allowing the verification process to efficiently select and use the appropriate set based on the challenge data, thereby reducing computation time during actual authentication while maintaining security.
2Adaptability or versatility
If multiple encrypted data sets are transmitted from the client, then variations in response keys are achieved, but data transmission volume increases
Solution Approach 1:
The system extracts only the necessary components for authentication: instead of transmitting all encrypted data sets, the client transmits only the selected encrypted data set that corresponds to the challenge data. The server independently generates the same response key using its own copy of the encrypted data set, eliminating the need to transmit multiple encrypted data sets while still achieving response key variations.
Solution Approach 2:
The challenge data serves multiple functions: it acts as a randomizer for response key generation, an identifier for selecting the appropriate encrypted data set, and a basis for verifying the authentication. This multi-functionality reduces the amount of data that needs to be transmitted while achieving the same security goals.
3Reliability
If signature verification is performed on parameter data, then falsification is prevented, but processing time increases
Solution Approach 1:
The system performs partial signature verification by only verifying the signature on the parameter data that is necessary for selecting the encrypted data set, rather than verifying all transmitted data. This selective verification approach maintains data integrity for critical components while reducing overall processing time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A server issues challenge data and transmits the challenge data to a client. The client stores encrypted group data including a plurality of encrypted data encrypted with a server key, and parameter data A, in a memory, receives the challenge data, generates response data using a response key on the client side, and transmits the response data, the encrypted group data, and the parameter data A to the server. The server selects encrypted data to be used from the received encrypted group data, based on the received parameter data A, sets a response key on the server side, based on the selected encrypted data and data decrypted with the server key, verifies the received response data, based on the challenge data and the response key on the server side, and notifies a result of the verification to the client. The client receives the notification.