Device-User Key Session Authentication Against Phishing Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing resource management systems rely on device or user certificates alone, which are agnostic to the device-user combination, leaving them vulnerable to fraudulent acts like phishing and man-in-the-middle attacks, and do not provide secure initial and continued access.
Innovation Solution
A trust anchor for both the device and user, combined with a public/private key pair generated at the device, is used to register a unique device/user identifier, enabling secure initial and continued access to services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device or user certificates alone are used for authentication, then the authentication process is simple, but the system is vulnerable to fraudulent acts like phishing and man-in-the-middle attacks
Solution Approach 1:
The patent combines device certificates, user certificates, and cryptographic key pairs into a unified authentication mechanism. The device user key binds the device identity and user identity together, creating a composite credential that cannot be used independently by either component alone, thereby preventing phishing and man-in-the-middle attacks while maintaining a structured authentication flow
Solution Approach 2:
The authentication credential is constructed as a composite structure containing multiple layers of security: device certificate, user certificate, and cryptographic signatures. This composite credential provides multi-factor authentication properties where each component contributes a different security layer, making the overall system resistant to various attack vectors
2Reliability
If a device user key with public/private key pair is implemented, then security against fraudulent acts is enhanced, but the device complexity increases
Solution Approach 1:
The device autonomously generates its own cryptographic key pair and manages the private key locally without requiring external key management infrastructure. The device uses its private key to sign authentication requests and manages the lifecycle of cryptographic materials independently, reducing the complexity burden on the central system while enhancing security
Solution Approach 2:
The patent introduces a resource management system as an intermediary that facilitates key registration and verification without requiring direct peer-to-peer cryptographic operations between devices. The intermediary handles the registration of device user keys and provides verification services, simplifying the overall system architecture while maintaining strong security properties
Data Source
AI summary
Mechanisms for resource management are described. A trust anchor for a device may be obtained. A trust anchor for a user may be obtained. A public key of the device that corresponds to a private key stored in a cryptographic component internal to the device may be generated. The public key of the device may be registered, with a service operated by a resource management system, to a combination of the device and user. Registering the public key of the device may include sending, to the service operated by the resource management system, a registration message that indicates the trust anchor for the device, the trust anchor for the user, and the public key of the device.