Client Authentication via Zero-Knowledge Proof and Masked Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods are vulnerable to server or client memory compromise and replay attacks, as they rely on secret elements being stored or transmitted in plaintext, making them susceptible to unauthorized access and fraud.
Innovation Solution
A method using a pseudo-homomorphic function to generate an authentication token on the client device, which is then verified by the server without revealing the secret element, employing zero-knowledge proof techniques and masked tokens to ensure secure knowledge proof without disclosing the secret element.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server stores secret elements in plaintext or encrypted form, then authentication verification is enabled, but the system becomes vulnerable to memory compromise attacks
Solution Approach 1:
The secret element is extracted from the server's memory storage and kept exclusively on the client device. The server only stores public keys and verification data, not the secret element itself. This extraction eliminates the vulnerability to server memory compromise while maintaining authentication capability.
Solution Approach 2:
A public key cryptographic system acts as an intermediary between the client's secret element and the server's verification process. The server verifies authentication through public keys without ever accessing the secret element, mediating the authentication process in a way that protects against memory compromise.
2Ease of operation
If the client stores secret element in memory, then local verification is enabled, but the system becomes vulnerable to client memory compromise
Solution Approach 1:
The secret element is extracted from the client's persistent memory storage and kept only in volatile memory during active authentication sessions. This reduces the attack surface for memory compromise while enabling local verification operations.
Solution Approach 2:
The system changes the state of the secret element from persistent stored form to transient in-memory form, and further to cryptographic hash forms during verification. This parameter change in how the secret element exists and is processed reduces vulnerability to memory compromise attacks.
3Reliability
If secret element is transmitted during authentication, then server verification is enabled, but the system becomes vulnerable to replay attacks
Solution Approach 1:
The authentication system uses periodic challenges issued by the server that require the client to generate time-varying responses based on the secret element. This periodic challenge-response mechanism ensures that each authentication is unique and prevents replay of previous authentication data.
Solution Approach 2:
The system transforms the static secret element into dynamic authentication tokens through cryptographic operations with changing parameters (nonces, timestamps, challenge values). This parameter transformation ensures that the same secret element produces different authentication data each time, preventing replay attacks.
4Reliability
If complex cryptographic operations are used to protect secret element, then security is improved, but device complexity increases making implementation difficult on mobile devices
Solution Approach 1:
Complex cryptographic setup operations (key pair generation, certificate creation) are performed in advance during device provisioning or first-time setup. This preliminary action moves the computational burden away from ongoing authentication operations on mobile devices, reducing implementation complexity while maintaining security.
Solution Approach 2:
The client device autonomously performs cryptographic operations locally using its own secret element and stored public keys, without requiring complex server-side processing or specialized hardware. This self-service approach simplifies the overall system implementation while maintaining strong security through client-side cryptographic operations.
Data Source
AI summary
The invention relates to a method for authenticating a client device holding an authentication token generated using a pseudo-homomorphic function and from a secret element (PIN) known only to the client device, to a server, comprising: - the generation (A1), by the client device, of a proof of knowledge of the secret element from a proof generation key masked with a mask data, said masked proof generation key being a function of said secret element, - transmission, to the server, by the client device of said generated proof of knowledge of the secret element (A2) and of the authentication token (J) masked using the mask data (A3), - verification of the validity of the masked authentication token (A4),and the validity of the server's proof of knowledge (A6) by a zero-disclosure proof of knowledge demonstrating the client device's knowledge of said secret element without disclosing it.