Client Process Authentication via Internal Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security methods for client/server communications rely on external storage of sensitive information, which is vulnerable to access by foreign processes on trusted client devices, and are ineffective in preventing unauthorized access in compromised environments.
Innovation Solution
A method of authenticating a client process by storing a reference hash set internally, which includes hashes of client binary files, and performing a two-phase authentication process involving process detail verification and random message validation without relying on external information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive information is stored in external systems (databases, key value stores), then authentication can be performed, but the system becomes vulnerable to access by foreign processes on trusted client devices
Solution Approach 1:
The patent extracts the authentication verification process from external systems and implements it locally within the client process. The server sends authentication challenges that are verified using locally-stored cryptographic material (binary files with digital signatures) rather than querying external databases, thereby eliminating the attack vector where foreign processes could intercept external communication.
Solution Approach 2:
The patent introduces digital signatures and cryptographic verification as an intermediary mechanism between the client process and server. Instead of directly sharing sensitive authentication data, the system uses signed binary files as a trusted intermediary that proves authenticity without exposing secret material to external systems or foreign processes.
2Reliability
If encryption keys are stored externally, then data protection is achieved, but human errors (accidental changes, leaks) can compromise security
Solution Approach 1:
The patent implements self-service authentication where the client process autonomously verifies its own authentication credentials using locally-stored signed binary files. The verification process is automated and does not require human intervention for key management, eliminating errors from manual handling of encryption keys while maintaining strong cryptographic protection.
3Productivity
If conventional authentication methods are used, then client processes can access server resources, but foreign processes on compromised devices can also access sensitive information
Solution Approach 1:
The patent performs preliminary verification of the client process identity before granting access to server resources. The server sends authentication challenges that must be verified using locally-stored cryptographic material before any sensitive operations are permitted, preventing foreign processes from accessing server resources even on compromised devices.
Solution Approach 2:
The patent implements location-specific authentication where each client process is authenticated based on locally-stored cryptographic material unique to that process. The authentication verification occurs locally within the client process boundary, ensuring that even if a device is compromised, foreign processes cannot utilize another process's authentication credentials.
Data Source
AI summary
An authenticating method including storing internally a reference hash set having hashes of genuine client binary and/or library files. The method further includes receiving an authentication request for authentication of the client process to authorize the client process to access a server resource provided by the server process. In a first phase, the method further includes requesting from the client OS, the process details and the hashes of the client binary and/or library files and verifying (using the reference hash set) these hashes received. In a second phase the method further includes, contingent on positive verification in the first phase, transmitting a random message to the client process by locating it using the IP address and PID presented during the authentication request, verifying a copy of the random message received back from the client process, and contingent on positive verification in the second phase, allowing the client process to access the requested server resource.