Identity-Based Signature Key Delegation via Hash Chain Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication protocols, such as those from the FIDO Alliance, face inefficiencies in device delegation due to the need for certificate chains in challenge-response mechanisms, leading to increased communication and computational costs, as well as energy consumption, particularly in battery-powered devices.
Innovation Solution
The method employs an identity-based signature scheme combined with cryptographic hash chains, where new signing keys are generated by traversing a hash chain based on the number of requests, eliminating the need to transmit explicit certificate chains by using any string as a public verification key, thereby reducing communication complexity and power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate chain is sent as part of the challenge-response protocol for device delegation, then authentication security is maintained, but communication complexity and energy consumption increase
Solution Approach 1:
The patent extracts the essential authentication function from the certificate chain mechanism. Instead of transmitting the entire certificate chain, the system uses a simplified delegation token that contains only the necessary authentication information, eliminating redundant data transmission while maintaining security.
Solution Approach 2:
The patent creates a simplified copy of the authentication mechanism. The delegation token acts as a condensed version of the certificate chain, preserving the essential authentication function while reducing the data size and transmission requirements, similar to how a summary or abstract represents the main content without all details.
2Reliability
If a certificate chain is transmitted for device delegation, then authentication validity is ensured, but communication costs and time complexity increase
Solution Approach 1:
The patent extracts only the essential authentication information from the certificate chain, removing unnecessary intermediate certificates and metadata. The delegation token contains minimal data sufficient for validation, significantly reducing the time required to transmit and process authentication information.
3Adaptability or versatility
If a certificate chain is used in the challenge-response protocol, then device delegation functionality is achieved, but computational costs increase
Solution Approach 1:
The patent creates a simplified computational model for device delegation. Instead of processing entire certificate chains with multiple verification steps, the system uses a streamlined delegation token that requires fewer computational operations, reducing the processing burden while maintaining delegation functionality.
Data Source
AI summary
Techniques are provided for communication-efficient device delegation. One method comprises, in response to a request for a new signing key of a given device, determining a number of new signing key requests received for the user of the given device; determining a new public verification key of the given device for an identity-based signature scheme by traversing a cryptographic hash chain backwards from a position of an initial selected value of the cryptographic hash chain; computing a new signing key based on public parameters and secret parameters of a backup component and the initial selected value; and providing the new public verification key and the new signing key to the given device. The given device authenticates to an authentication service using an identity-based signature computed using the new signing key. The request for the new signing key is submitted, for example, when the given device is lost, damaged, unavailable or stolen.