Message Authentication Using One-Way Hash Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message authentication methods for embedded, real-time control systems are inadequate due to their reliance on Message Authentication Codes, which require shared secrets and are vulnerable to compromise, and Public Key Encryption, which is computationally intensive and resource-heavy, making them unsuitable for unicast, broadcast, or multicast transmissions in resource-constrained environments.
Innovation Solution
A secure, low-computation authentication method using a one-way hash function to create and distribute an initial trusted bit string, allowing recipients to authenticate messages without shared secrets, ensuring that no single compromised receiver can endanger the entire network, and utilizing multiple trusted bit strings for enhanced security and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Message Authentication Codes are used for message authentication, then authentication security is improved, but system vulnerability increases because all recipients share a common secret that can be compromised if any single receiver is compromised
Solution Approach 1:
The patent segments the authentication mechanism by assigning each recipient a unique authentication value derived from the sender's private key through one-way hash functions, rather than using a shared secret. This segmentation ensures that compromise of one recipient's authentication value does not affect others, as each value is independently generated and verified through cryptographic hashing.
Solution Approach 2:
The patent introduces the sender's private key as an intermediary that indirectly authenticates messages to all recipients. Instead of direct shared secrets between sender and each recipient, the private key serves as a common root from which individual authentication values are derived through one-way hash functions, providing both security and non-repudiation.
2Reliability
If Public Key Encryption is used for message authentication, then authentication security is improved, but computational resource consumption increases making it unsuitable for embedded real-time control systems
Solution Approach 1:
The patent extracts the computationally intensive key exchange and decryption operations from the message authentication process. By using the sender's private key to generate authentication values through one-way hash functions and having recipients verify these through lightweight hash operations, the solution removes heavy computational burden from real-time authentication while maintaining security.
Solution Approach 2:
The patent employs disposable authentication values generated through one-way hash functions that are computationally inexpensive to compute and verify. Each authentication value can be used once or limited times, providing fresh security credentials without requiring complex cryptographic operations, making it suitable for resource-constrained embedded systems.
3Reliability
If Message Authentication Codes with shared secrets are used, then authentication capability is improved, but system complexity increases due to key distribution and management requirements
Solution Approach 1:
The patent creates a universal authentication mechanism where the sender's private key serves multiple functions: generating authentication values for multiple recipients, providing non-repudiation, and enabling scalable authentication without individual key pairs for each recipient. This multi-functionality simplifies key management compared to traditional symmetric or asymmetric authentication schemes.
Solution Approach 2:
The patent performs preliminary authentication setup by distributing the sender's public key and the structure of one-way hash function generation to all recipients before actual message authentication occurs. This preliminary action eliminates the need for ongoing key distribution and management, as the authentication mechanism is pre-configured and can be used immediately for message verification.
Data Source
AI summary
Methods and systems for using simple authenticated messages are disclosed for use with implementing (i) synchronization schemes, (ii) encoded control messaging schemes, and (iii) encrypted data communication schemes. Messages are authenticated by applying a secure hash function to one or more authentication tokens to produce hash results which are compared to stored trusted bit strings, wherein the stored trusted bit strings are replaced with the most-recently received authentication token whose corresponding hash result matched the stored bit string.