Device Key Derivation for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital content distribution systems face inefficiencies in key management, as storing a unique cryptographic key per device is inefficient and compromises one device's key can compromise all others sharing the same model key, leading to insecure authentication.
Innovation Solution
A method where the device stores only a device key derived from a master key, with the web application server generating a derived key and proof of possession using a cryptographic algorithm, allowing verification without storing the master key on each device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a unique cryptographic key is stored per device on the application server, then device authentication can be performed, but key management becomes extremely inefficient and complex
Solution Approach 1:
The patent segments the cryptographic key into two parts: a master key stored securely on the application server and a device-specific key stored locally on each device. The device-specific key is derived from the master key using a cryptographic algorithm and a unique device identifier. This segmentation allows the system to maintain authentication security while significantly reducing key management complexity, as the application server only needs to store and manage the single master key rather than multiple device-specific keys.
Solution Approach 2:
The patent introduces a device identifier as an intermediary element that links the master key to the device-specific key. The device identifier is unique to each device and is used in the cryptographic derivation process. This intermediary allows the system to associate the master key with specific devices without storing multiple master keys, thereby simplifying key management while maintaining authentication reliability.
2Device complexity
If multiple devices share the same device model key, then key management is simplified, but security is compromised if one device's key is illegally retrieved
Solution Approach 1:
The patent segments the key into a master key (shared across devices) and a device-specific key (unique to each device). The device-specific key is derived by combining the master key with a unique device identifier through a cryptographic algorithm. This segmentation ensures that even though multiple devices share the same master key, each device has a unique derived key, preventing security compromise if one device's key is illegally retrieved.
Solution Approach 2:
The patent applies local quality by making each device's effective key unique through the device-specific key, while maintaining a shared master key for key management simplicity. The device-specific key is generated locally on each device using its unique identifier, ensuring that each device has a distinct authentication credential without requiring the system to manage multiple master keys.
3Reliability
If the application server stores and maintains a key per device, then authentication can be verified, but the server must store and maintain multiple keys increasing storage requirements and management overhead
Solution Approach 1:
The patent segments the key storage requirement by introducing a master key (stored once on the application server) and device-specific keys (generated locally on each device). The device-specific key is derived from the master key and a unique device identifier using a cryptographic algorithm. This segmentation reduces the number of keys the application server must store and manage from multiple device-specific keys to just a single master key, while still enabling authentication verification for each device.
Solution Approach 2:
The patent extracts the device-specific key generation and storage function from the application server and places it on the device itself. Each device generates its own device-specific key locally using the master key and its unique identifier, eliminating the need for the application server to store and maintain multiple device-specific keys. This extraction significantly reduces the quantity of keys the server must manage while maintaining authentication capability.
Data Source
AI summary
One embodiment of the invention sets forth a mechanism for verifying the authenticity of a device before transmitting digital content to the device. In operation, the device stores a device key that is generated at manufacture-time using a pre-determined cryptographic key and the device identifier. In operation, the device generates a proof of possession from the application data and the stored device key. When verifying the device authenticity, a device key is derived from the master key and the device identifier then a proof of possession is derived from the derived device key and the application data obtained from the device. If the derived proof of possession matches the received proof of possession, then the authenticity of the device can be verified.