Identity-Based Key Derivation for Multi-User Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-user applications face challenges in authenticating communications due to the need to maintain thousands of public and private keys, which exceeds the capabilities of current public key infrastructure and requires excessive system resources and frequent key refreshes.
Innovation Solution
Implementing an identity-based cryptographic scheme that uses user-specific identifiers to derive cryptographic keys, combined with a directory service that maintains user-specific public keys, allowing applications to authenticate communications without storing multiple keys and reducing the need for frequent key refreshes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional public key infrastructure is used to authenticate communications between multi-user applications, then authentication security is maintained, but system resource consumption increases excessively due to storing and managing thousands of key pairs
Solution Approach 1:
The patent extracts the public key storage burden from individual applications by introducing a centralized directory service that stores all user public keys. Applications no longer need to maintain thousands of public keys locally; instead, they retrieve only the specific public key needed for authentication from the directory service, significantly reducing local storage requirements while maintaining authentication security.
Solution Approach 2:
The patent introduces a directory service as an intermediary between applications and the public key infrastructure. This mediator handles the storage, management, and distribution of public keys, allowing applications to authenticate communications without directly managing the complexity of thousands of key pairs. The directory service acts as a centralized repository that simplifies key access and management.
2Adaptability or versatility
If traditional public key infrastructure is used with multiple user-specific key pairs, then user-specific authentication is enabled, but system resources and key refresh frequency requirements increase excessively
Solution Approach 1:
The patent implements a universal authentication mechanism where a single user-specific private key can authenticate multiple types of communications and operations. Instead of requiring separate key pairs for different authentication scenarios, the identity-based cryptographic scheme allows one private key to serve multiple authentication purposes, reducing the need for frequent key generation and refresh operations while maintaining user-specific authentication capabilities.
3Ease of operation
If applications store multiple public keys locally for authentication verification, then authentication verification capability is maintained, but memory and storage requirements increase excessively
Solution Approach 1:
The patent extracts the public key storage function from individual application memory to a centralized directory service. Applications verify authentication by retrieving public keys from the directory service as needed, rather than storing multiple public keys locally. This extraction significantly reduces the quantity of stored key data in each application while maintaining the ability to verify authentication for multiple users.
Data Source
AI summary
Techniques are disclosed relating to authenticating communications. A computer system may generate a master private key usable to derive user-specific private keys for a plurality of users hosted by a particular application. The computer system may generate master public configuration information usable to derive user-specific public keys for the plurality of users. The computer system may send that configuration information to a directory service accessible to applications that communicate with the particular application. The computer system may receive, from the particular application, a request for a user-specific private key for one of the plurality of users. The request may include an identifier of the user. The computer system may perform a key derivation function to generate a particular user-specific private key based on the master private key and the identifier of the user. The computer system may send the particular user-specific private key to the particular application.