Authentication Access Control With Ciphertext Identity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity authentication methods in network communication security fail to ensure confidentiality of identity information, leaving it vulnerable to interception and misuse by attackers, and do not effectively resist quantum computation or dictionary brute force attacks.
Innovation Solution
Implementing a pre-shared key authentication mechanism with ciphertext-based identity information transmission and key exchange calculations like Diffie-Hellman (DH) to ensure confidentiality and resist attacks, allowing mutual or unilateral identity authentication between a requesting device and an authentication access controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-shared key authentication mechanism is used for identity verification, then authentication between requesting device and access controller is achieved, but identity information is exposed directly during authentication message transmission
Solution Approach 1:
The patent introduces ciphertext as an intermediary to transmit identity information. Instead of sending plain identity information, the system encrypts it using a message encryption key to generate ciphertext, which is then transmitted during authentication. This intermediary layer protects the original identity information from exposure while still enabling verification.
Solution Approach 2:
The patent transforms identity information from its original plaintext form into an encrypted ciphertext form by changing the parameter state through encryption. This parameter change ensures that the identity information cannot be directly read or intercepted in useful form during transmission, yet remains verifiable through decryption with the appropriate key.
2Ease of operation
If identity information is transmitted in plaintext during authentication, then verification is simplified, but security against interception and misuse is compromised
Solution Approach 1:
Ciphertext serves as an intermediary that maintains both security and functionality. The authentication process remains relatively simple because the overall flow (send identity, verify identity) is unchanged, but the intermediary ciphertext form provides security against interception and misuse by attackers.
3Ease of manufacture
If traditional authentication methods are used, then implementation is straightforward, but resistance to quantum computation and dictionary brute force attacks is insufficient
Solution Approach 1:
The patent combines multiple cryptographic elements to create a composite authentication mechanism. It integrates pre-shared keys, message encryption keys, ciphertext generation, and key exchange calculations (such as Diffie-Hellman) into a unified system. This composite approach maintains implementation feasibility while providing robust resistance against quantum computation and dictionary brute force attacks through the layered cryptographic structure.
Data Source
AI summary
Disclosed is an identity authentication method. When a request device and an authentication access controller perform identity verification on the basis of an authentication mechanism of a pre-shared key, identity information of a verified party is transmitted in the form of a ciphertext, thereby preventing the identity information of the verified party from being directly exposed during transmission, and ensuring that an attacker cannot obtain private and sensitive information. Two-way or one-way identity authentication between the authentication access controller and the request device is realized, while the confidentiality of entity identity related information is ensured, thereby laying the foundation for ensuring that a user accessing a network is legitimate and/or the network accessed by the user is legitimate. Moreover, the dictionary brute-force attack resistance or quantum computation attack resistance during authentication is enhanced in conjunction with key exchange computation and by means of ingenious detail designs. Also disclosed are an authentication access controller, a request device, a storage medium, a program, and a program product.