Cryptographic Operation Security Element Environment Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication methods using security elements, such as USB tokens or SIM cards, are vulnerable to unauthorized access if the security element is lost, as the service provider cannot distinguish between the legitimate and unauthorized users.
Innovation Solution
Introducing a central entity that redirects the request message to the security element, encrypting it with an environment-dependent first cryptographic key, which is decrypted using a second key generated by the security element based on its current environment, ensuring the response message is environment-independent and allowing the service provider to verify authenticity without increased effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If environment-dependent cryptographic keys are used to enhance security, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a central instance as an intermediary between the service provider and the security element. This central instance handles the complex environment verification and cryptographic key management, shielding the service provider from complexity while maintaining enhanced security through environment-dependent verification
2Reliability
If environment verification is implemented to prevent unauthorized access, then security is improved, but the complexity of the authentication process increases
Solution Approach 1:
The security element autonomously determines its current environment and generates environment-dependent cryptographic keys without requiring service provider intervention. This self-service capability maintains security while simplifying the overall authentication process from the service provider's perspective
Data Source
Figure 1
Figure 2
AI summary
In a procedure for performing a cryptographic operation between a security element (20) and a service provider (10), the service provider sends (S1) a request message (A), which is cryptographically processed (S7) by the security element (20) and sent as a response message to the service provider (S8), who then verifies (S9). A central instance (100) receives the request message (A) from the service provider (10), generates (S2) a first cryptographic key (Ku), which depends on a predefined environment (U) of the security element (20), encrypts (S3) the request message (A) using the first cryptographic key (Ku), and sends (S4) the encrypted request message to the security element (20).The security element (20) generates (S5) a second cryptographic key (KU'), which depends on a current environment (U') of the security element (20), and decrypts (S6) the encrypted request message using the second cryptographic key (KU').