Token-Based IKE Phase 1 Key Refresh Without User Interaction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key exchange and authentication protocols, such as IKE, require periodic refreshing of keying material, which often necessitates user intervention, leading to inefficiencies and potential session hijacking risks when users are unavailable or disconnected.
Innovation Solution
A token is generated and shared between a client and server during initial authentication, allowing for secure refresh of keying material without user intervention, using the token to prove identity and prevent session hijacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user credentials are required for keying material refresh, then security is maintained, but user intervention is required causing inefficiency and potential disconnection issues
Solution Approach 1:
A token is generated and stored during the initial authentication phase (IKE phase 1), before the keying material refresh is needed. This preliminary action allows the client to prove its identity during subsequent keying material refresh operations without requiring user intervention, thus maintaining security while improving ease of operation.
2Productivity
If administrator refreshes keying material without user prompting, then user availability is not required, but session hijacking vulnerability increases
Solution Approach 1:
A token acts as an intermediary credential between the client and server for authentication during keying material refresh. Instead of directly using administrator privileges or user credentials, the token serves as a secure mediator that proves the client's identity without exposing session information that could be hijacked, thus enabling efficient refresh while mitigating session hijacking risks.
3Extent of automation
If token-based authentication is implemented, then user intervention is eliminated and security is enhanced, but system complexity increases
Solution Approach 1:
The token is generated and distributed during the initial authentication phase, which is already a required step in IKE protocol. By performing the token setup action preliminarily, the system avoids adding separate token management steps during routine operations, thus achieving automation without proportionally increasing operational complexity.
Data Source
AI summary
Methods and apparatus are provided to allow Internet Key Exchange (IKE) phase 1 keying materials to be periodically refreshed in a secure manner without requiring user interaction. A client and server perform authentication and key exchange during set up of a secure connection. A token is passed to the client by the server during or after the initial user authentication phase. The token is stored both at the client and at the server. Instead of requiring user credentials, the token can be used to securely prove the identity of the client.