Mutual Verification Between Client and Server Using Public-Private Key Pairs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based security mechanisms are cumbersome for users, vulnerable to cyber crimes, and lack mutual verification between clients and servers, allowing for potential data tampering and DNS hacking.
Innovation Solution
A token-based mechanism using public-private key pairs for mutual verification between clients and servers, where a logon token is generated and encrypted, ensuring secure identity verification without passwords, and protecting against DNS hijacking by using IP addresses instead of domain names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based security mechanism is used, then client identity verification is provided, but client security against server tampering and DNS hacking is not provided
Solution Approach 1:
The patent introduces a third-party authentication server as an intermediary between the client and the web server. This authentication server issues digital certificates to both the client and the web server, enabling mutual verification. The intermediary architecture allows the client to verify the web server's identity through certificate validation, preventing server tampering and DNS hacking without compromising client identity verification capabilities.
2Reliability
If different passwords are set for different websites, then website-specific security is improved, but user convenience and ease of operation deteriorate
Solution Approach 1:
The patent implements a universal authentication server that serves multiple websites with a single authentication mechanism. Instead of requiring users to manage different passwords for each website, the system uses digital certificates issued by the authentication server that can be validated across multiple sites. This multi-functional approach maintains website-specific security through individual certificates while providing user convenience through a unified authentication process.
3Ease of operation
If domain names are used for server connection, then user-friendly access is improved, but security against DNS hacking deteriorates
Solution Approach 1:
The authentication server acts as an intermediary that validates the web server's digital certificate before allowing access. This certificate validation mechanism verifies the server's true identity independently of domain name resolution, protecting against DNS hacking while maintaining user-friendly domain name access. The intermediary verification ensures that even if DNS is compromised, the client can detect and prevent connection to malicious servers.
4Device complexity
If passwords are used for authentication, then simple implementation is achieved, but vulnerability to cyber crimes increases
Solution Approach 1:
The patent replaces the mechanical password-based authentication system with a cryptographic system using digital certificates and public-key infrastructure. Instead of relying on simple password strings that are vulnerable to hacking, the system uses mathematically secure cryptographic operations for authentication. This substitution maintains implementation simplicity through automated certificate validation while dramatically reducing vulnerability to cyber crimes through cryptographic security.
Data Source
AI summary
A method of mutual verification between a client and a server is disclosed. The method comprises receiving a request via a telecommunication link, the request comprising an address of the server; receiving a verification data; decrypting the verification data with a private key of the server; identifying an account identity (ID) of the client from the decrypted verification data; generating a first logon token; generating a logon message comprising the first logon token and a uniform resource locator (URL) of the server; encrypting the logon message with a public key of the client; transmitting the logon message via the telecommunication link; receiving a logon request comprising the account ID and a second logon token; and determining whether the second logon token matches the first logon token.