HTTP Digest Authentication via Token Issuing Entity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing HTTP digest authentication methods require storing shared secrets like passwords, which is cumbersome and poses a security risk due to the need for storing sensitive information.
Innovation Solution
The method involves receiving an encrypted token with a token secret from a token issuing entity, creating a response using the challenge and token secret, and forwarding it to the service provider for authentication, eliminating the need for pre-shared secrets between the client and server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared secrets like passwords are stored for authentication, then authentication can be performed, but security risk increases due to the need to store sensitive information
Solution Approach 1:
The patent extracts the shared secret storage requirement from the authentication system by introducing a token-based approach. Instead of storing passwords or shared secrets on the server, the system uses tokens that are encrypted and signed, eliminating the need to store sensitive authentication credentials while maintaining authentication reliability.
Solution Approach 2:
The patent introduces a token as an intermediary between the client and server for authentication. The token contains encrypted and signed information that enables authentication without requiring the server to store shared secrets. The token acts as a mediator that carries authentication information securely throughout the system.
2Reliability
If pre-shared secrets are used between client and server, then authentication can be established, but device complexity increases due to secret management requirements
Solution Approach 1:
The patent removes the complex secret management infrastructure by replacing pre-shared secrets with a token-based system. The server no longer needs to store, manage, or synchronize shared secrets with clients. Instead, it issues encrypted and signed tokens that simplify the authentication process while maintaining security.
Solution Approach 2:
The patent performs preliminary authentication actions by issuing tokens before the actual authentication challenge. The token is pre-encrypted and signed with the server's private key, so that when the client receives the challenge, it can use the pre-provided token information to generate the response without needing any prior secret sharing or complex setup.
Data Source
AI summary
A method and system for hypertext transfer protocol digest authentication through the use of a token issuing entity trusted by both a client and a service provider. The token issuing entity may issue an encrypted token and a token secret to the client. The client may then use the token secret instead of a password for digest authentication, and provided the encrypted token along with the digest authentication response to the service provider. The service provider may decrypt the encrypted token to obtain the token secret, which may then be used for digest authentication with the client.