Client-Driven Shared Secret Updates for Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems based on shared secrets fail to ensure that the secret remains unknown to other parties, leading to vulnerabilities such as Man-in-the-Middle attacks, and lack effective mechanisms to detect unauthorized use or cloning of the secret.
Innovation Solution
Implementing client-driven shared secret updates, where the client updates the shared secret after successful authentication, creating a chain of secrets that can be used to detect inconsistencies and anomalies, such as unauthorized access, by incorporating authentication information like timestamps and random values into the new secret, and using password vaults or browser extensions to manage these updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared secret is used for authentication between client and server, then authentication efficiency is improved, but the risk of secret compromise increases because multiple clients may share the same secret
Solution Approach 1:
The patent implements dynamic secret evolution where the shared secret automatically updates after each successful authentication. The client and server both update their stored secrets to a new value derived from the previous secret and authentication data, ensuring the secret changes over time while maintaining authentication continuity for legitimate users
Solution Approach 2:
The system performs preliminary verification by checking whether the submitted secret matches the stored secret before allowing authentication. This preliminary check prevents unauthorized access while enabling legitimate authentication, and the subsequent secret update occurs only after successful verification
2Ease of operation
If a shared secret remains static for long-term use, then ease of operation is improved, but the vulnerability to attacks increases due to extended valid lifetime
Solution Approach 1:
The patent implements periodic secret updates triggered by each successful authentication event. Rather than requiring manual intervention or fixed time intervals, the secret automatically evolves with each use, creating a periodic refresh mechanism that balances operational simplicity with security enhancement
Solution Approach 2:
The system changes the secret parameter itself over time through cryptographic derivation. Each new secret is generated by applying a derivation function to the previous secret combined with authentication data, fundamentally changing the secret value while maintaining a predictable update mechanism
3Reliability
If the server stores multiple versions of shared secrets for different clients, then detection of unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent segments the secret management by associating each secret with unique authentication data (such as client identifiers, timestamps, or random values). This segmentation allows the server to distinguish between different client secrets and detect when an unauthorized party attempts to use a secret not associated with their authentication data
Data Source
AI summary
Techniques are provided for client-driven shared secret updates for client authentication. One method comprises, in response to a first authentication of a client by a server using a given shared secret, updating, by the client, the given shared secret to generate an updated shared secret and storing the updated shared secret with the server; and submitting the updated shared secret to the server as part of a second authentication of the client. The updating is optionally performed by one or more of a password vault and a browser extension. The client may randomly select the updated shared secret or compute the updated shared secret in a predefined manner. The server may evaluate whether the client stores the updated shared secret with the server in connection with the first authentication and implement one or more predefined steps when the updated shared secret is not stored with the server.