Client Credential Based Secure Session Authentication Method
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure session authentication methods in client-server environments are either computationally intensive or lack data integrity, making them unsuitable for devices with limited cryptographic capabilities, such as wireless devices, and are vulnerable to data modification or injection attacks.
Innovation Solution
A secure session authentication method using a shared secret credential, such as a password, to create a message authentication code (MAC) that ensures data integrity by utilizing a MAC function known to both the client and server, with optional extensions like sequence numbers to prevent replay attacks and secure pseudo-random number generators to expand the credential.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simple authentication methods like basic authentication or HTTP Post-based authentication over SSL/TLS are used, then authentication can be established, but the device complexity and computational overhead increase significantly
Solution Approach 1:
The patent uses disposable session tokens instead of persistent cryptographic keys. Each session uses a temporary token that is discarded after use, eliminating the need for complex key management infrastructure while maintaining security. The token is generated once per session and never reused, providing strong authentication without requiring devices to maintain complex cryptographic state.
2Reliability
If strong cryptographic capabilities like public/private key systems are used, then data integrity and authentication are improved, but the computational overhead and bandwidth consumption increase
Solution Approach 1:
The patent extracts only the essential authentication function from complex cryptographic protocols. Instead of implementing full SSL/TLS with public key infrastructure, the system uses a simplified token-based approach where a single secret value is shared between client and server. This extracted minimal cryptographic primitive provides sufficient data integrity protection without the computational burden of full public key systems.
3Productivity
If challenge-response sequences like NTLM authentication are used, then computational overhead is reduced, but data source authentication is not guaranteed
Solution Approach 1:
The patent combines the speed of simple token passing with the security of cryptographic hashing. The authentication mechanism uses a composite approach: a shared secret is hashed with the token to create a MAC (Message Authentication Code). This composite structure provides both the computational efficiency of simple token exchange and the data source authentication guarantees of cryptographic verification, preventing both replay attacks and data modification.
4Reliability
If SSL/TLS is used to protect data integrity, then security is improved, but the number of information exchanges and setup complexity increase
Solution Approach 1:
The patent performs preliminary authentication using a shared secret before the actual data transfer begins. The MAC is computed in advance over the entire message including future data, providing forward secrecy without requiring complex protocol handshakes. This preliminary action eliminates the need for continuous cryptographic verification during data transfer, simplifying the protocol implementation while maintaining strong session security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and apparatus for client credential based authentication of messages between a client and a server, the client and server both knowing the client credential, the method having the steps of: utilizing the client credential to create a key; and using the key to authenticate messages between the client and the server.