Client Device Authentication Using Server Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods, such as user-supplied PINs, provide insufficient security due to low entropy, making them vulnerable to attacks and inadequate for government and regulated environments, and existing key-stretching algorithms are not sufficient to meet stringent security standards.
Innovation Solution
A system and method that utilizes time-limited entropy generated by a server, which is encrypted and sent to a client device, allowing access to static entropy for authentication, and includes a mechanism for hard authentication if the time-limited entropy expires, enhancing security by using a combination of time-limited and static entropy to derive cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a user-supplied PIN is used for authentication, then ease of operation is improved, but security is worsened due to insufficient entropy
Solution Approach 1:
The authentication system is segmented into multiple components: a simple user-supplied PIN for ease of entry, and a server-generated time-limited entropy value for security. The PIN and entropy work together through a key derivation function to create cryptographic keys, separating the usability function from the security function.
Solution Approach 2:
A key derivation function acts as an intermediary between the low-entropy PIN and the high-entropy time-limited entropy. This intermediary combines both inputs to generate cryptographic keys, allowing the simple PIN to be transformed into a secure authentication mechanism when combined with the entropy mediator.
2Reliability
If key-stretching algorithms are applied to user-supplied PINs, then security is improved, but the algorithms are still inadequate for regulated environments
Solution Approach 1:
The system changes the entropy parameter by introducing server-generated time-limited entropy with high randomness (e.g., 128 bits or more) to supplement the user-supplied PIN. This parameter change transforms the authentication system from inadequate entropy to sufficient entropy for government and regulated environments.
3Reliability
If time-limited entropy is generated and sent to client devices, then security is improved, but device complexity increases
Solution Approach 1:
The server automatically generates time-limited entropy values and sends them to client devices without requiring manual configuration or complex local entropy generation mechanisms. The client device simply receives, stores, and uses the entropy provided by the server, making the system self-service oriented and reducing client-side complexity.
4Reliability
If hard authentication is required when time-limited entropy expires, then security is improved, but loss of time occurs
Solution Approach 1:
The system performs preliminary authentication by generating and distributing time-limited entropy before it expires. Users can authenticate during the valid time window without interruption, and the system proactively manages entropy renewal to prevent authentication disruptions, avoiding the need for time-consuming hard authentication during critical operations.
Data Source
AI summary
Methods and systems for authenticating a client device using entropy provided by a server and/or a device paired with the client device are described herein. The client device may receive a first user credential. The client device may receive first entropy from a wireless device. The client device may decrypt, using the first entropy, second entropy generated by a server. The client device may decrypt, using the second entropy, a second user credential that was stored in the client device. Based on a comparison of the first user credential with the second user credential, the client device may grant a user of the client device access to one or more resources.