Access Control Credential Validation for Copied Device Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access control systems fail to detect when secure data, such as credentials, are copied from one device to another, allowing malicious devices to gain unauthorized access without detection.
Innovation Solution
An access control architecture that generates diversified keys based on master keys and key diversification inputs, enabling mutual authentication and validation of credentials to detect and prevent unauthorized data copying.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control systems use credentials for authentication, then access control functionality is provided, but the system cannot detect when credentials are copied to unauthorized devices
Solution Approach 1:
The credential is segmented into multiple components: a credential blob containing encrypted credential data and a portion of key diversification input, and diversified keys generated through key derivation functions. This segmentation allows the system to verify credential authenticity without exposing sensitive key material, enabling detection of copied credentials while maintaining manageable system complexity.
Solution Approach 2:
A credential verification system acts as an intermediary between the mobile device and access control decisions. The verifier uses key derivation functions to generate expected diversified keys from stored key material and compares them against keys derived from the credential blob, enabling detection of credential copying without requiring direct access to master keys.
2Reliability
If the access control system implements credential verification with key diversification, then security against copied credentials is improved, but the authentication process becomes more complex
Solution Approach 1:
The system changes parameters by deriving multiple diversified keys from a single master key through key derivation functions that take different key diversification inputs. This allows the system to generate unique authentication keys for different purposes (encryption, authentication) without managing multiple master keys, improving security while controlling complexity through parameter-based key generation.
Solution Approach 2:
The credential blob is pre-generated with embedded key diversification input and encrypted credential data. This preliminary preparation allows the verification system to quickly derive and compare diversified keys during authentication without performing complex cryptographic operations in real-time, enhancing security while maintaining efficient authentication processes.
3Reliability
If mutual authentication with session key generation is implemented, then detection of unauthorized devices is enabled, but the authentication protocol complexity increases
Solution Approach 1:
The mutual authentication protocol incorporates feedback mechanisms where each party verifies the other's identity through challenge-response exchanges using diversified keys. The system provides feedback by validating the credential blob and comparing derived keys, enabling detection of malicious devices that cannot produce valid authentication responses, while the structured feedback loops keep the protocol complexity manageable.
Data Source
AI summary
A method for leveraging an access control architecture for detecting secure data copied between devices according to an embodiment includes, by a credential system, generating an authentication diversified key based on a master key and a first key diversification input, generating an encryption diversified key based on the master key and a second key diversification input, generating a credential blob including an encrypted credential for a mobile device and a portion of the second key diversification input, and transmitting the credential blob to the mobile device, and by a reader device, receiving credential data from the mobile device including an encrypted version of the credential blob, generating the encryption diversified key based on the master key and the second key diversification input, validating the credential data based on the encryption diversified key, and extracting the credential for use in an access control decision.