ID Token Authentication via Shared Secret End-to-End Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods using smart cards are inefficient and insecure, particularly with contactless cards, where complex PIN verification protocols increase processing time and require shared secrets between the computer and ID token, which can be compromised if no input is provided on the PC.
Innovation Solution
A method using an ID token with a shared secret managed by a user authentication module for end-to-end encryption, allowing efficient authentication across multiple programs within a security domain without permanent user secrets being handed over, utilizing contactless communication and energy harvesting for the ID token.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex PIN verification protocols are used with contactless smart cards, then security is improved, but authentication time increases
Solution Approach 1:
The patent applies preliminary action by establishing a secure channel and performing authentication before the actual data exchange begins. The secure channel is set up in advance using cryptographic protocols, and the authentication token is verified before the smart card data is accessed, preventing the need for repeated complex verification during subsequent operations.
Solution Approach 2:
The patent introduces an intermediary approach by using a trusted service provider (TSP) that acts as a mediator between the smart card and the application. The TSP handles the complex cryptographic verification operations, allowing the smart card to authenticate once while the TSP manages the secure communication channel for subsequent data exchanges, reducing authentication time for multiple programs.
2Productivity
If a shared secret is stored between computer and ID token, then authentication efficiency is improved, but security is worsened if no input is provided on PC
Solution Approach 1:
The patent extracts the secret input requirement from the computer side and places it on the smart card side. The smart card requires the user to enter a PIN or provide biometric data locally, and this input is never transmitted to the computer. The computer only receives an authentication token, not the actual secret, eliminating the security risk of storing shared secrets on the computer while maintaining authentication efficiency.
Solution Approach 2:
The patent uses disposable authentication tokens that are generated for each authentication session and then discarded. Instead of relying on long-lived shared secrets stored on the computer, the system uses short-lived tokens that are validated once and then destroyed, preventing replay attacks and eliminating the need for persistent secret storage on the computer.
3Reliability
If user PIN is verified for each downstream program, then security is improved, but user convenience deteriorates
Solution Approach 1:
The patent merges multiple authentication requirements into a single authentication event. The smart card performs user verification once, and the resulting authentication token is then presented to multiple downstream programs within the same security domain. This consolidation allows the user to authenticate once while maintaining security across multiple applications, improving convenience without sacrificing security.
Solution Approach 2:
The patent creates a universal authentication mechanism where a single authentication token generated by the smart card can be used across multiple programs and services within the security domain. The token contains sufficient cryptographic proof of authentication that can be verified by any authorized program, eliminating the need for program-specific PIN verification while maintaining security standards.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for authenticating a user in relation to a plurality of programs (330, 332, 334, 336) of the same security domains by means of a computer (300) and an ID token (200), wherein the computer (300) and the ID token (200) each comprise a common shared secret (232) which is provided to carry out an end-to-end encryption, wherein the common shared secret (232) is managed on the computer (300) side by a user authentication module (322). The method comprises the following steps: carrying out a first communication session between the first program and the ID token (200), wherein the first communication session involves a data exchange according to a request-response protocol, which is protected by an end-to-end encryption using the common shared secret (232); after the first communication session has ended, switching to a second communication session between the second program and the ID token (200), wherein the second communication session involves a data exchange according to a request-response protocol, which is protected by an end-to-end encryption using the common shared secret (232).