Keyed Pseudo-Random Number Generator for Time-Synchronized Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing pseudo-random token-based authentication systems are vulnerable to synchronization issues due to clock divergence between client and server, and the security of leading hash functions has been questioned, making them time-sensitive and potentially insecure.

Innovation Solution

A method and system that utilize a pseudo-random number generation scheme incorporating a secret key and state information, where the state information includes prior generated pseudo-random numbers, allowing for synchronization between client and server without relying on a shared time base, using a hash function and synchronization logic to ensure authentication accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a shared time base is used for synchronization between client and server, then authentication timing can be coordinated, but the system becomes vulnerable to clock divergence and time-sensitive failures

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidtime synchronization complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the time dependency from the authentication system by removing the shared time base requirement. Instead of using absolute time values for synchronization, the system uses relative time offsets and sequence numbers that do not depend on synchronized clocks between client and server, thereby eliminating clock divergence vulnerabilities while maintaining authentication reliability

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Rather than synchronizing clocks to achieve time coordination, the patent inverts the approach by using time-independent sequence numbers and relative time offsets. The system counts authentication attempts and uses these sequence numbers to generate synchronized pseudo-random values without requiring the client and server clocks to be synchronized, thus solving the time synchronization problem through inversion of the conventional approach

Inventive Principle:

Principle #13The other way round (Inversion)

2Reliability

If leading hash functions are used to generate pseudo-random token codes, then authentication security can be provided, but security vulnerabilities arise when the hash function security is questioned

Engineering Contradiction:

Improveauthentication securityVSAvoidhash function adaptability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic adaptability in the hash function selection and parameters. The system can adaptively choose different hash functions and adjust their parameters based on security requirements and computational constraints. This dynamic approach allows the system to respond to emerging security vulnerabilities by updating the hash function algorithm without requiring complete system redesign, thereby maintaining both security and adaptability

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent employs parameter changes in the hash function by using variable salt values, adjustable iteration counts, and configurable output lengths. These parameter variations enhance security by preventing pre-computation attacks and ensuring that even if one hash function becomes vulnerable, the system can adjust parameters to maintain security while preserving adaptability to different security requirements

Inventive Principle:

Principle #35Parameter changes

3Reliability

If pseudo-random token codes are generated with short validity periods, then security against replay attacks is improved, but authentication failures increase due to timing sensitivity

Engineering Contradiction:

Improvereplay attack resistanceVSAvoidauthentication ease

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent applies preliminary action by pre-calculating and caching valid sequence number ranges and their corresponding pseudo-random values on both client and server sides. This allows the system to accept authentication requests within a valid time window without requiring real-time synchronization, as the valid range is predetermined. This preliminary preparation maintains replay attack resistance through short validity periods while improving ease of operation by reducing timing sensitivity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements beforehand cushioning by maintaining a buffer of valid sequence numbers and allowing a grace period for authentication submissions. Both client and server maintain buffers of acceptable sequence number ranges that accommodate minor timing variations and network delays. This cushioning approach preserves security by limiting the window for replay attacks while reducing authentication failures due to timing sensitivity, as minor delays fall within the buffered acceptance range

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentUS8660268B2Keyed pseudo-random number generator

Publication Date: 2014.02.25 RED HAT INC

AI summary

A method and apparatus for client authentication using a pseudo-random number generation system. The pseudo-random number generation utilizes a secret key as well as state information as input into the hash function to generate a pseudo-random number. The state information that is part of the input can be any number of prior generated pseudo-random numbers. The authentication allows for synchronization of the client and server by exchanging state information. The authentication is not dependent on any absolute time and consequently the client and servers are not required to maintain a reliable shared time base.