IKE Message Authenticity Verification in VPN Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of a global pre-shared key (PSK) for all VPN clients poses a significant security risk, as a compromised device can render the PSK useless or dangerous, and can be exploited for man-in-the-middle (MITM) attacks.
Innovation Solution
A VPN client verifies the authenticity of Internet Key Exchange (IKE) messages received from a VPN server by using a cryptographic public key from a server profile, ensuring communication with a legitimate VPN server and preventing MITM attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a global pre-shared key is used for all VPN clients, then authentication is simplified and ease of operation is improved, but security is worsened because a compromised device can render the PSK useless and enable MITM attacks
Solution Approach 1:
The patent segments the authentication process into two distinct components: (1) PSK-based authentication for establishing the initial connection, and (2) certificate-based verification for verifying the server's identity. This segmentation allows the system to maintain ease of operation through PSK while improving security through certificate verification, preventing MITM attacks by ensuring the client communicates with the legitimate server.
Solution Approach 2:
The patent implements preliminary action by having the server present its certificate to the client during the IKE phase 1 exchange, before any sensitive data or further authentication steps occur. The client is configured with the server's certificate in advance and performs verification before proceeding with the VPN connection establishment. This preliminary verification ensures that even if the PSK is compromised, the client can detect MITM attacks before establishing the tunnel.
2Reliability
If certificate verification is added to IKE messages, then security against MITM attacks is improved, but device complexity increases
Solution Approach 1:
The patent uses the existing IKE protocol and its built-in certificate exchange mechanisms as an intermediary to facilitate secure communication. Rather than implementing a completely new authentication protocol, the solution leverages the IKE framework that both client and server already support, adding certificate verification within the established protocol structure. This reduces the increase in device complexity by reusing existing infrastructure.
Solution Approach 2:
The patent makes the authentication system multi-functional by enabling it to support both PSK-based authentication and certificate-based verification within the same IKE framework. The client and server can perform both authentication methods simultaneously - using PSK for initial connection establishment and certificate verification for server identity confirmation. This universality allows the system to achieve enhanced security without requiring separate dedicated systems for each authentication method.
Data Source
AI summary
Some examples relate to a verifying the authenticity of IKE exchange messages in a VPN. In an example, a VPN client sends a VPN server profile request message to a VPN server for establishing a VPN connection. In response, the VPN server provides a VPN server profile to the VPN client. The VPN server profile comprises a cryptographic public key associated with a server certificate of the VPN server. The VPN client stores the VPN server profile and sends an IKE message to the VPN server. In response to the IKE message, the VPN server sends a signed IKE response message. Upon receipt, the VPN client verifies the authenticity of the signed IKE response message. If the signed IKE message is successfully verified, the VPN client sends an identity of the VPN client to the VPN server.