Identity Authentication Using Nonce-Protected Certificate Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity information of authentication access controllers, often carried in digital certificates, is vulnerable to interception by attackers, posing severe security risks to the controllers, requesters, and networks.
Innovation Solution
Confidentiality processing is applied to identity information and authentication results using a protection nonce and message encryption, ensuring that even if intercepted, attackers cannot access private or sensitive information, thus securing the authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If identity information is transmitted during authentication, then authentication can be performed, but sensitive information may be intercepted and exposed
Solution Approach 1:
The patent introduces a trusted third-party authentication server as an intermediary between the authentication access controller and the requester. This server generates and manages digital certificates, acting as a mediator that enables authentication without directly exposing sensitive identity information between the controller and requester. The intermediary structure ensures that sensitive information remains with the authentication server while still enabling verification.
Solution Approach 2:
The patent uses digital certificates as copies of identity information. Instead of transmitting actual sensitive identity data, the system transmits verified certificate copies that contain only necessary verification information. These certificates are generated by the trusted authentication server and serve as safe replicas that prove identity without exposing the original sensitive information.
2Reliability
If digital certificates are used for identity authentication, then identity verification is enabled, but private information in certificates may be exposed during transmission
Solution Approach 1:
The patent extracts only the necessary verification information from the digital certificate and transmits only that specific part. The authentication server extracts the relevant verification data from the complete certificate structure, separating it from the sensitive private information that should remain protected. This extraction approach enables verification while minimizing information exposure.
Solution Approach 2:
The trusted authentication server acts as an intermediary that handles the digital certificates securely. It extracts and transmits only the verification-necessary portions of certificates while keeping the complete certificates and sensitive information secured on the server side. This intermediary approach prevents direct exposure of private information during transmission.
3Ease of operation
If identity information is transmitted openly, then authentication process is simple, but security risks increase significantly
Solution Approach 1:
The patent replaces direct transmission of sensitive identity information with transmission of digital certificate copies. These certificate copies contain verified identity information in a standardized format that is easy to process and verify, maintaining operational simplicity while eliminating the security vulnerability of transmitting raw sensitive data.
Solution Approach 2:
The patent transforms identity information into a different parameter format through digital signing and encryption. Instead of transmitting plain text identity data, the system transmits encoded certificate data with digital signatures, changing the parameter representation to balance simplicity of verification with enhanced security protection.
Data Source
AI summary
Disclosed is an identity authentication method. During the process of a requesting device authenticating the identity of an authentication access controller, confidentiality processing is performed on identity information that carries private and sensitive information, and identity authentication result information, thus private and sensitive information can be prevented from being exposed, such that an attacker cannot acquire private and sensitive information in a first authentication response message or an authentication result message even if they have intercepted same, thereby preventing an attack of an attacker on a legitimate authentication access controller, and ensuring the security of the authentication access controller, the requesting device and even a network. Further disclosed are an identity authentication apparatus, a storage medium, a program, and a program product.