Dynamic Device Tag Invalidation for Replay Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional device identification methods using device tags are vulnerable to interception and copying, leading to identity theft and online fraud, and fail to track devices when tags are lost, removed, or deleted.
Innovation Solution
A system employing dynamic device tags with a static and dynamic portion, where the dynamic portion changes upon each validation, allowing for resilient and restorable identification by invalidating and updating tags to detect unauthorized use and mitigate loss or deletion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional device tags are used for identification, then device identification is simple and straightforward, but the system becomes vulnerable to interception and copying attacks
Solution Approach 1:
The patent implements dynamic device tags where the identification data changes over time through periodic updates and invalidation of previous tags. This dynamic nature prevents attackers from using stolen tags indefinitely, as the tags expire and are replaced regularly, thus maintaining security while preserving identification functionality
Solution Approach 2:
The system employs periodic regeneration and invalidation of device tags at scheduled intervals. This periodic action ensures that even if a tag is intercepted, its useful life is limited, and the system automatically refreshes authentication credentials to maintain security without requiring complex user intervention
2Reliability
If device tags are updated frequently to improve security, then resistance to copying attacks increases, but the complexity of tag management increases
Solution Approach 1:
The device tag system automatically handles updates, validations, and regenerations without requiring manual user intervention. The client device and server automatically manage the tag lifecycle including reception, storage, presentation, and renewal, reducing management complexity while maintaining frequent updates for security
Solution Approach 2:
The system implements feedback mechanisms where the server validates device tags and provides guidance on their status (valid, expired, needs renewal). This automated feedback loop simplifies management by providing clear status information and automatically triggering regeneration when needed, reducing the burden on users and systems
3Reliability
If device tags are invalidated after use to prevent replay attacks, then security against replay attacks improves, but the ability to track known devices is lost
Solution Approach 1:
The system performs preliminary validation of device tags against a database of known valid tags before accepting them. This preliminary check allows the system to recognize and track authenticated devices while simultaneously preventing replay attacks, as invalid or previously used tags are rejected before they can be exploited
Solution Approach 2:
The patent replaces the simple invalidation mechanism with a more sophisticated validation system that checks tags against a database of authorized identifiers. This substitution maintains the security benefit of invalidating used tags while preserving tracking capability through positive identification of authorized devices in the database
4Reliability
If multiple device tags are distributed across different storage locations to prevent loss, then resilience to tag deletion improves, but the complexity of retrieving all tags increases
Solution Approach 1:
The device tag system divides authentication credentials into multiple separate tags stored in different locations on the client device. This segmentation provides resilience because if one tag is deleted or compromised, other tags remain available for authentication, maintaining system reliability while distributing risk
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A computer system receives a request to access a server. The request includes a first device tag set. When the first device tag set matches a previously assigned device tag set, the computer system allows access to the server without requesting full access credentials of a user. The computer system invalidates the first device tag set, and sends a second device tag set. When the first device tag set does not match the previously assigned device tag set, the computer system requests full access credentials from the user.