Ephemeral Key Authentication for Computing Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The deployment of static cryptographic keys in authentication services of computing facilities poses security risks, as they can be leaked, leading to unauthorized access and compromise of sensitive data.
Innovation Solution
Implementing ephemeral cryptographic keys with a finite lifespan, generated on-demand or asynchronously, and using a separate secure location for the private key, ensuring only authorized access to the key generation process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static cryptographic keys are deployed in authentication services, then authentication functionality is provided, but security risks increase due to potential key leakage
Solution Approach 1:
The patent transitions from static cryptographic keys to dynamic ephemeral keys that are generated on-demand for each authentication request. The authentication service generates a key pair, uses the private key to sign the security token, and then discards the key pair. This dynamic approach ensures that even if one ephemeral key is compromised, it cannot be used to authenticate future tokens, thereby resolving the security vulnerability of static keys while maintaining authentication reliability
Solution Approach 2:
The patent implements ephemeral cryptographic keys that have a finite lifespan and are discarded after use. Each authentication request generates a new key pair that exists only temporarily for the duration of that authentication operation. This disposable approach to cryptographic keys eliminates the long-term security risks associated with static keys, as compromised ephemeral keys become immediately useless after their brief operational lifetime
2Reliability
If ephemeral cryptographic keys are generated on-demand, then security risks are reduced, but computational overhead increases
Solution Approach 1:
The patent extracts the computationally intensive key generation operation from the critical path of authentication. The ephemeral key pair is generated in advance by the authentication service before the actual authentication request is processed. This extraction allows the key to be ready when needed, reducing the computational burden during the authentication request handling while still providing the security benefits of ephemeral keys
Solution Approach 2:
The patent performs preliminary key generation by creating the ephemeral key pair before the authentication request is fully processed. The authentication service generates the key pair in advance, signs the security token with the private key, and then discards the key pair. This preliminary action distributes the computational workload over time, preventing peak resource consumption during authentication requests while maintaining the security advantages of on-demand ephemeral key generation
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Techniques of data authentication in a distributed computing system are disclosed herein. One example technique includes receiving a request for performing an operation along with a data package that includes a security token, a first digital signature of the security token generated using an ephemeral private key, and an ephemeral public key with a second digital signature generated using a master private key stored at a secure location. The example technique can also include initially validating the second digital signature using a public key corresponding to the master private key, and upon validating the second digital signature, validating the first digital signature of the security token using the ephemeral public key included in the data package. Upon validating that the first digital signature of the security token, the request can be authenticated, and the requested operation can be performed.