Identity-Based Encryption for Mobile Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secured information exchange systems for mobile devices lack robust authentication and encryption methods, particularly in server-initiated communication, leading to vulnerabilities such as compromised login credentials, device theft, and lack of unified authorization and encryption for push and pull communication.
Innovation Solution
An authentication and secured information exchange system utilizing a device identification and management module for identity-based encryption, digital token authentication, and context-based encryption, along with Public Key Infrastructure (PKI) for generating and verifying digital certificates, ensuring secure communication between mobile devices and servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If basic user level authentication and SSL/TSL based encryption is used, then the system is easy to implement, but security gaps remain and sensitive information is vulnerable to compromise
Solution Approach 1:
The authentication system is segmented into multiple independent components: device identification module, digital certificate verification module, token generation module, and biometric authentication module. Each component handles a specific aspect of security, creating layered protection without requiring complete redesign of the entire system.
Solution Approach 2:
The patent combines multiple authentication methods (device ID, digital certificates, tokens, biometrics) into a composite authentication system. This composite approach integrates different security mechanisms that work together to provide robust protection while maintaining implementation feasibility through modular architecture.
2Ease of operation
If server private key is distributed to all client devices, then authentication is simplified, but all client devices become vulnerable if the private key is compromised
Solution Approach 1:
Each client device generates and stores its own unique private key locally, rather than distributing a single server private key to all devices. The server stores public keys for each device, enabling individual authentication while maintaining centralized control. This local key management ensures that compromise of one device's key does not affect other devices.
Solution Approach 2:
Digital certificates act as intermediaries between the server and client devices. The server issues digital certificates to authorized devices, which contain the device's public key and identity information. This intermediary mechanism enables simplified authentication for devices while maintaining secure key management on the server side.
3Reliability
If device identification is included as authentication component, then authorization is enhanced, but the system complexity increases
Solution Approach 1:
The device identification module serves multiple functions: it provides unique device fingerprinting, enables certificate generation, supports token authentication, and facilitates biometric binding. This multi-functional approach enhances authorization capabilities while avoiding the need for separate systems for each function, thereby limiting the increase in overall system complexity.
4Reliability
If comprehensive authentication parameters are verified, then access control is strengthened, but the authentication process time increases
Solution Approach 1:
Device identifiers and digital certificates are generated and stored in advance during device registration, before actual authentication is needed. Token authentication data is pre-configured on devices. When authentication is required, the system verifies pre-computed values rather than performing complex calculations in real-time, significantly reducing authentication time while maintaining strong access control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Identity based encryption (IBE). An IBE server assigns a private and public key pair to a client device based on a unique identification of the client device. To establish an encrypted session with the client device a server device requests the client device's public key from the IBE server. Authentication of the client and the server by the IBE server is based on credentials or a token. Assigned keys are securely stored in an embedded trusted platform provided in the client device.