Device Authentication Tokens for Secure Non-Traceable Channel Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods between devices require sharing secret keys, making the system vulnerable if a single device is compromised, and lack non-traceability, as well as relying on complex key management systems.
Innovation Solution
A method where each device is provided with a set of authentication tokens for other groups, comprising a random number and its cipher using the group secret key, allowing for secure channel establishment without shared keys, ensuring non-traceability through token renewal at each communication, and enabling viral revocation and update propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices share a secret key for authentication, then authentication can be performed, but the system becomes vulnerable if a single device is compromised
Solution Approach 1:
The patent segments the authentication system by introducing group-specific secret keys (one per group) instead of a single shared secret key across all devices. Each device belongs to multiple groups and holds multiple group secret keys. This segmentation ensures that compromising one device only exposes the group keys of the groups that device belongs to, not all group keys in the system, thereby limiting the scope of damage from a security breach.
Solution Approach 2:
The patent applies local quality by making each device's secret key holdings specific to its group memberships. Each device has a tailored set of group secret keys corresponding to the groups it belongs to, rather than a universal key. This localized key distribution enhances security by ensuring that key exposure is contained to specific groups rather than propagating system-wide.
2Ease of operation
If devices use group public keys for authentication, then authentication can be performed without sharing secret keys, but traceability of individual devices is lost
Solution Approach 1:
The patent introduces dynamic authentication tokens that are renewed with each authentication session. These tokens are generated by encrypting session-specific random numbers with group secret keys. The dynamic nature of these tokens provides forward secrecy, where past session tokens cannot be used to compromise future sessions, and session keys are not reused, thereby preventing traceability while maintaining authentication capability.
3Reliability
If each device hosts unique private keys and certificates, then key diversification is achieved, but complex key management systems are required
Solution Approach 1:
The patent changes the fundamental parameter of key management from asymmetric key pairs (public-private certificates) to symmetric group secret keys. This parameter change simplifies the key management architecture by eliminating the need for complex certificate authorities, certificate validation chains, and public key infrastructure. The symmetric key approach maintains key diversification through group-specific keys while dramatically reducing system complexity.
4Loss of information
If authentication tokens are renewed at each communication, then non-traceability is enhanced, but computational overhead increases
Solution Approach 1:
The patent substitutes computationally intensive asymmetric cryptography (RSA, ECC) with efficient symmetric encryption algorithms (AES, 3DES) for token generation and verification. This mechanical substitution in the cryptographic domain maintains strong non-traceability through frequent token renewal while dramatically reducing the computational energy required for each authentication operation.
Data Source
AI summary
The present invention relates to a method to authenticate two devices (D1, D2) to establish a secure channel (SCKs), one belonging to a first group (G1) of devices, the second belonging to a second group (G2) of devices, in a non-traceable manner without necessitating to share secret, each group (Gx) being authenticated by an authority (AUx) that stores a group secret key (Kx) into the devices (Dx) under its authority, The method uses a set of authentication tokens (ΑΤχ'), one for each of the other groups (Gx') with which the device (Dx) is intended to communicate, said authentication token (ΑΤχ') comprising at least a random number (Rx') and a cipher (Cx') of at least this random number (R') by the secret key (ΑΚχ') of each of these other groups (Gx'), said authentication tokens (ATx) being further renewed at each communication with a device (Dx') from another group (Gx').