Device Authentication via Vendor-Provided Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of sharing secrets for secure and authenticated communications is vulnerable to theft by malicious third parties, compromising the security of digital transactions.
Innovation Solution
A system and method for authenticating devices using authentication information provided by vendors to credentialing services, where devices derive encryption keys based on tokens provisioned by vendors, enabling secure credential issuance and message authentication codes to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared secrets are transmitted or stored for authentication, then device authentication can be achieved, but security is compromised due to potential theft by malicious third parties
Solution Approach 1:
The patent extracts the secret from the transmission and storage process entirely. Instead of sharing secrets between parties, each device independently generates authentication credentials using its own private key, eliminating the need to transmit or store shared secrets that could be stolen.
Solution Approach 2:
The patent introduces a credential verifier as an intermediary that issues credentials to devices based on their public keys. This mediator enables authentication without requiring direct secret sharing between communicating parties, thus preventing secret theft while maintaining authentication reliability.
2Reliability
If encryption keys are derived and shared between parties, then secure communications can be established, but the complexity of key management increases
Solution Approach 1:
Each device independently generates its own private key and derives encryption keys locally using its private key and the credential verifier's public key. This self-service approach eliminates the need for complex centralized key management systems while ensuring secure communications.
Solution Approach 2:
Devices perform preliminary key generation and credential derivation actions before actual communication occurs. The private key is generated in advance, and the credential is obtained beforehand, so that during communication, only simple key derivation and encryption operations are needed, reducing operational complexity.
Data Source
AI summary
A computer-implemented method for authenticating devices may include (1) identifying a request from a device for a credentialing service to issue a credential to the device, the request including an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device, (2) transmitting the request to the credentialing service, (3) receiving, from the credentialing service, the credential encrypted using a second encryption key, the second encryption key having been derived by the device based on the token, and (4) providing the encrypted credential to the device. Various other methods, systems, and computer-readable media are also disclosed.