Encrypted Token Authentication for Low-Latency Secure Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for clients interacting with applications/services are inefficient, leading to increased latency and resource usage due to cumbersome processing and potential security vulnerabilities from long-valid digital certificates in scenarios like online gaming, where users typically have short sessions.
Innovation Solution
A method where a client provides an encrypted token upon initial connection, which serves as proof of authentication and contains an encryption key, allowing the server to establish secure communication without additional processing or intervention from an authentication service, using pre-shared decryption and signature verification keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods with digital certificates are used, then security is provided, but processing efficiency decreases and latency increases
Solution Approach 1:
The patent segments the authentication process into two distinct phases: (1) initial authentication using traditional digital certificates with a certification authority, and (2) subsequent communication using session-specific encryption keys exchanged directly between client and server. This segmentation eliminates the need for continuous CA involvement, reducing processing overhead and latency while maintaining security.
Solution Approach 2:
The patent implements preliminary action by establishing encryption keys and authentication credentials during the initial connection phase. The server and client perform certificate verification and key exchange upfront, storing these credentials for reuse during the session. This preliminary setup eliminates repeated authentication operations, significantly improving processing efficiency for subsequent communications.
2Ease of operation
If digital certificates with long validity periods are used, then authentication is simplified, but security vulnerabilities increase
Solution Approach 1:
The patent applies dynamics by making encryption keys session-specific and time-limited rather than using static, long-validity certificates for ongoing communication. Each session generates fresh encryption keys that are automatically invalidated when the session ends. This dynamic key management maintains authentication simplicity while eliminating security vulnerabilities associated with long-lived certificates, as compromised keys only affect the specific session in which they were used.
3Reliability
If continuous re-issuance of digital certificates is performed, then security is maintained, but computing resources and storage increase
Solution Approach 1:
The patent extracts the certificate verification step from the ongoing communication process, limiting CA involvement to the initial authentication phase only. Once authentication is complete, the system uses locally-stored session keys for encryption and decryption without requiring further certificate operations. This extraction eliminates continuous computing resource consumption for certificate management while maintaining security through the initial verification and session key protection.
Solution Approach 2:
The patent implements self-service by enabling the client and server to autonomously perform encryption and decryption using session-specific keys exchanged during initial authentication. This self-service mechanism eliminates the need for continuous external authentication service involvement, reducing computing resource consumption and storage requirements for certificate management while maintaining security through cryptographic protection.
4Reliability
If traditional authentication lookup operations are performed, then client identification is verified, but latency in execution increases
Solution Approach 1:
The patent performs client identification verification as a preliminary action during the initial connection phase using digital certificates and CA verification. The authenticated client identity and session keys are cached locally for the duration of the session. This preliminary verification eliminates the need for repeated lookup operations during subsequent communications, significantly reducing execution latency while maintaining reliable client identification through the initial authentication and session key binding.
Data Source
AI summary
The present disclosure relates to processing operations configured to efficiently enable a client and a server to establish secure communication upon initial connection between the client and the server. Upon initial connection to with the server, the client provides an encrypted token which serves as both proof of authentication/identity and provides, in the encrypted token, an encryption key that the server can utilize to initiate secure communication with the client. The server is able to trust the encrypted token and the encryption key because the encrypted token is signed and encrypted by an authentication service that has a trusted relationship with the server and because the authentication service has pre-shared decryption and signature verification keys with the server. The server utilizes the encrypted key to secure communications with the client without requiring additional processing to lookup client identity or any further intervention from the authentication service.