Cryptographic Firewall for Network Access Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in securely transmitting sensitive information over public computer networks like the Internet, as making resources available over these networks increases vulnerability to malicious attacks and unauthorized access.
Innovation Solution
A security device employing cryptographic techniques, such as hash generation, is used to authenticate client systems by comparing one-time password hashes based on identifiers and counter values, ensuring only authorized access to network resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If organizations make resources available over public networks like the Internet, then accessibility and communication capability are improved, but vulnerability to malicious attacks and unauthorized access increases
Solution Approach 1:
The patent introduces a cryptographic firewall as an intermediary device positioned between the public network and protected network resources. This firewall acts as a mediator that filters and controls network traffic using cryptographic authentication mechanisms, allowing legitimate access while blocking malicious attempts, thus resolving the contradiction between network accessibility and security vulnerability
Solution Approach 2:
The system performs preliminary cryptographic authentication of network packets before allowing access to protected resources. By verifying digital signatures and authentication codes in advance, the system prevents unauthorized access attempts from reaching the target resources, thereby maintaining accessibility while preemptively neutralizing security threats
2Reliability
If encryption techniques are used to secure information transmission, then security is improved, but processing overhead and complexity increase
Solution Approach 1:
The cryptographic processing is segmented into distinct functional components: packet inspection, authentication code verification, digital signature validation, and decryption operations. Each component handles a specific aspect of security processing independently, which modularizes the complexity and makes the system more manageable while maintaining comprehensive security
Solution Approach 2:
The system employs self-service cryptographic mechanisms where packets carry their own authentication codes and digital signatures that can be verified autonomously without requiring continuous manual intervention or complex centralized authentication protocols, thereby reducing processing overhead while maintaining security
Data Source
AI summary
A method is performed at a security device. The method includes establishing a network connection with a client system. After establishing the network connection, the security device receives a first packet from the client system. The first packet includes an identifier, a first counter value, and a first one-time password hash generated by the client system. Based on the identifier received, the security device retrieves from a trusted data store the seed and a second counter value. If the first counter value is larger than the second counter value, the security device generates a second one-time password hash based on the identifier, the first counter value, and the seed. In accordance with a determination that the first and second one-time password hashes match, the security device grants, to the client system, access to one or more network resources protected by the security device via the network connection.