Client-Server Authentication via Shared Secret Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a challenge in ensuring the data integrity and authenticity of messages exchanged between a client and a server, as attackers can intercept and modify messages or impersonate the server, compromising the trustworthiness of communications.
Innovation Solution
The solution involves encrypting a shared secret using a public key and storing the corresponding private key in a secure information store, allowing the server to generate authentication data for messages, which the client can verify using the shared secret, ensuring the integrity and authenticity of communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional communication methods are used between client and server, then communication simplicity is maintained, but data integrity and authenticity cannot be ensured against attackers
Solution Approach 1:
The patent applies preliminary action by pre-establishing a shared secret between the client and server before communication begins. The server stores this shared secret in a secure license information store, and the client obtains it through a secure challenge-response authentication process. This preliminary setup enables subsequent messages to be authenticated using simple cryptographic operations without complex real-time key exchange protocols.
Solution Approach 2:
The patent introduces cryptographic intermediaries including digital signatures and shared secrets that mediate between the communication parties. The server signs messages with its private key, and the client verifies these signatures using the server's public key. The shared secret acts as an intermediary key that both parties possess, enabling them to authenticate each other and verify message integrity without directly exposing their private keys.
2Reliability
If no authentication mechanism is used, then communication speed is maintained, but message modification and impersonation attacks can occur
Solution Approach 1:
The patent changes the cryptographic parameters by using asymmetric cryptography (public-key infrastructure) for authentication setup, then transitioning to symmetric cryptography (shared secret) for message authentication. This parameter change allows the system to achieve strong security guarantees through digital signatures and HMAC verification while maintaining efficient communication once the authentication channel is established.
Solution Approach 2:
The authentication and key exchange operations are performed preliminarily before the main communication phase. The client and server establish their cryptographic identities and shared secrets in advance, allowing subsequent message exchanges to use lightweight verification mechanisms that minimize overhead and maintain high communication efficiency.
3Reliability
If the server stores private keys in a secure location, then authentication security is improved, but access to the private key for generating authentication data becomes more complex
Solution Approach 1:
The patent introduces the shared secret as an intermediary that bridges the server's secure private key storage and the authentication process. The server uses its private key only during the initial authentication phase to prove its identity and establish the shared secret. After this, the shared secret serves as the operational key for generating authentication data, eliminating the need for frequent private key access while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are described for ensuring data integrity and authentication of received messages. One technique includes sending a request from a first module to a second module in which the request includes a first portion that is a shared secret encrypted with a public key, obtaining by the second module a private key from a secure and trusted information store, such as a license information store, including license information or other application specific information for the first module, using the private key to decrypt the first portion and obtain the shared secret, sending a response from the second module to the first module in which the response includes authentication data and at least one data item used with the shared secret to determine the authentication data, and performing by the first module verification processing to verify the authentication data included in the response.