IPsec Authentication Tokens for Secure IKE Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pre-shared keys in Internet Protocol Security (IPsec) authentication are vulnerable to theft and inflexible, lacking scalability and mobility, especially in network environments involving different organizations or authorities.
Innovation Solution
A centralized authentication platform generates and manages tokens, which are used as pre-shared keys for Internet Key Exchange (IKE), enhancing security and mobility by dynamically generating keys based on device identifiers and configuring expiration periods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If pre-shared keys are used for IKE authentication, then configuration is simple, but security strength is insufficient and keys are vulnerable to theft
Solution Approach 1:
The patent implements dynamic key generation where pre-shared keys are replaced with dynamically generated tokens that change over time. The network node generates tokens based on device identifiers and transmission time, and these tokens are automatically updated without manual reconfiguration, maintaining configuration simplicity while significantly improving security strength through time-varying credentials.
Solution Approach 2:
The patent introduces a network node as an intermediary that automatically generates and distributes authentication tokens between devices. This intermediary eliminates the need for manual key sharing between end devices, simplifying configuration while enhancing security through centralized, controlled token distribution that prevents direct key exposure.
2Ease of operation
If static pre-shared keys are used, then authentication is straightforward, but scalability and mobility are limited across different organizations
Solution Approach 1:
The system replaces static pre-shared keys with dynamic tokens that can be automatically generated for different devices and organizations. Tokens are generated based on device identifiers and can be distributed automatically, enabling straightforward authentication while providing the scalability needed for multi-organization environments through automated token provisioning.
Solution Approach 2:
The network node implements a universal token generation mechanism that can serve multiple devices and organizations through a single infrastructure. The token generation system adapts to different device types and organizational requirements, providing both straightforward authentication and broad scalability across diverse network scenarios.
3Ease of manufacture
If manual key sharing is used, then key distribution is simple, but flexibility and automation are reduced
Solution Approach 1:
The network node serves as an automated intermediary that generates and distributes authentication tokens without requiring manual key sharing between end devices. This maintains simplicity from the user perspective while introducing full automation in the key distribution process through the intermediary node.
Solution Approach 2:
Devices automatically receive and use tokens generated by the network node without manual intervention. The system provides self-service authentication where devices can obtain their authentication credentials automatically, eliminating manual key distribution while maintaining operational simplicity.
4Stability of the object's composition
If long-term pre-shared keys are used, then authentication is stable, but security risk increases over time
Solution Approach 1:
The system implements time-varying authentication tokens that are automatically regenerated periodically or upon expiration. This maintains authentication stability through consistent automated renewal while reducing security risks by ensuring keys do not remain static long-term, thereby minimizing the window of opportunity for key theft.
Solution Approach 2:
Authentication tokens are renewed periodically through automated processes. The network node generates new tokens at scheduled intervals, maintaining stable authentication functionality while reducing long-term security risks through regular key rotation that limits exposure time.
Data Source
AI summary
Embodiments of the present disclosure provide a method and an apparatus for internet protocol security authentication. A method (100) performed by a first communication device comprises: connecting (S102) to a network node; receiving (S104) a token from the network node; and using (S106) the token for internet key exchange, IKE. According to embodiments of the present disclosure, by using a network node as a centralized authentication platform, which is able to generate and manage tokens and distribute them to authorized communication device, communication device can use the dynamically generated key to authenticate the IKE messages.