Authentication Key Exchange via Delta Distance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, such as using a random signed challenge text encrypted by the server, are complex and vulnerable to interception, while alternative methods like exchanging a list of one-time keys are cumbersome and error-prone.
Innovation Solution
Both the client and server agree on a starting value and algorithm to generate a pseudo-random binary sequence using an LFSR, with disturbances added at regular intervals to create a non-deterministic key sequence, where the client sends a delta key based on a new metric to authenticate, allowing for secure key exchange without repeating the entire sequence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a random signed challenge text encrypted by the server is used for authentication, then authentication security is improved, but the authentication procedure becomes very complex
Solution Approach 1:
The authentication process is segmented into two distinct phases: key exchange phase (where the LFSR-based key generation occurs) and authentication phase (where only the delta key is used). This segmentation allows the complex key generation to be performed once while keeping the actual authentication simple, resolving the contradiction between security and complexity.
Solution Approach 2:
The LFSR-based key sequence generation is performed as a preliminary action before authentication. By pre-generating and exchanging the key sequence (including the delta key) before the actual authentication challenge-response, the system establishes secure communication channels in advance, simplifying the subsequent authentication procedure while maintaining security.
2Reliability
If a list of one-time keys is exchanged before authentication, then authentication security is improved, but the key management becomes cumbersome and error-prone
Solution Approach 1:
The system implements self-service key generation where the LFSR automatically generates the key sequence based on a shared seed and public parameters. Both parties independently generate the same key sequence without requiring manual key distribution or storage, eliminating the need for cumbersome key management while maintaining security.
Solution Approach 2:
The patent changes the parameter approach from exchanging actual key values to exchanging derived parameters (the LFSR seed and public parameters). By working with parameters rather than keys, the system achieves secure authentication without requiring parties to store or manually manage lists of keys, resolving the contradiction between security and ease of operation.
3Ease of manufacture
If a deterministic PRBS is used for key generation, then key generation simplicity is improved, but the keys become predictable and vulnerable to attack
Solution Approach 1:
The system transforms the static deterministic LFSR into a dynamic system by introducing random disturbances at regular intervals. This dynamic modification prevents prediction of future keys while maintaining the simplicity of LFSR-based generation, resolving the contradiction between generation simplicity and key security.
Solution Approach 2:
The patent converts the harmful predictability of deterministic PRBS into a benefit by using the LFSR's structured generation (which is predictable) combined with controlled random disturbances. The structured LFSR provides simplicity and efficiency, while the inserted disturbances provide security, turning the potential vulnerability into a strength through deliberate design.
Data Source
AI summary
A client is intended to be authenticated with a server. According to the invention, this is done by means of the following method: a) the client and the server use an identical algorithm, but independently of one another, to produce a first key (Epsilon Key), b) the client produces a second key such that its distance (Delta) from the first key is within a predetermined distance, c) the said second key is sent to the server, d) the server successfully authenticates the client if the distance between the received second key and the first key is within the predetermined delta, e) the said second key is used as a new start key for further authentication of the client with the server.