eZKPI Mutual Authentication Protocol for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password-based user authentication methods are vulnerable to security concerns such as weak password choices, data leakage during transmission, and phishing attacks, particularly in online web-based applications, which compromise network security and personal data.
Innovation Solution
The implementation of an effective zero knowledge proof of identity (eZKPI) algorithm that combines something the user has (like a secure identification card) with something the user knows (like a password), using a 2-factor authentication scheme and high-level encryption to facilitate strong mutual authentication and session encryption key negotiation, reducing reliance on HTTPS and minimizing interception risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used over HTTP, then ease of operation is improved, but security is worsened due to data leakage during transmission
Solution Approach 1:
The patent introduces an intermediary mechanism (secure authentication protocol with challenge-response verification) between the user and the authentication system. Instead of directly transmitting passwords over HTTP, the system uses intermediate steps including generating challenges, verifying responses through cryptographic functions, and establishing secure sessions without exposing the actual password during transmission.
2Ease of operation
If weak passwords are allowed, then ease of operation is improved, but security is worsened due to vulnerability to dictionary attacks
Solution Approach 1:
The patent fundamentally changes the authentication parameter from password-based verification to cryptographic challenge-response verification. Instead of checking if a transmitted password matches a stored password, the system generates cryptographic challenges and verifies mathematical responses. This parameter change eliminates the vulnerability to dictionary attacks while maintaining ease of operation for legitimate users.
3Reliability
If HTTPS is used for secure transmission, then security is improved, but device complexity is worsened due to requirement for certificates and secure channels
Solution Approach 1:
The patent extracts the essential security function from the HTTPS protocol suite. Instead of requiring full HTTPS implementation with certificates, secure channel negotiation, and complex cryptographic handshakes, the invention extracts only the core authentication verification function and implements it through a simplified challenge-response mechanism that works over standard HTTP, eliminating the need for HTTPS infrastructure.
4Reliability
If mutual authentication is implemented, then security is improved, but ease of operation is worsened due to additional authentication steps
Solution Approach 1:
The patent implements mutual authentication through a self-service mechanism where the system automatically performs verification steps without requiring user awareness or intervention. The challenge-response protocol enables the server to authenticate the client and the client to authenticate the server through automated cryptographic verification, making the complex mutual authentication process transparent to the user and maintaining ease of operation.
Data Source
AI summary
In accordance with embodiments of the present disclosure, systems and methods for facilitating network transactions include user authentication over a network by providing strong mutual authentication of client web application to server side application server, providing session encryption key negotiation after authentication to continue encryption during communication, and providing a high-level encryption technique referred to as an effective zero knowledge proof of identity (eZKPI) algorithm. In various implementations, the eZKPI algorithm is adapted to couple something the user Knows (e.g., a password or personal identification number) with something the user Has (e.g., a secure identification card) to create a stronger identity authentication proof for access to a mobile device and applications running on the mobile device.