Master Digital Access Key System for Secure Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional master keys face issues with delegation and revocation complexities, as well as vulnerability to insiders and intruders, while multiple access tokens improve usability but complicate management and relationships, necessitating a solution that combines the advantages of both.

Innovation Solution

A master digital access key system that aggregates digital access tokens, using hash functions and Bloom filters to generate code words for secure authentication, allowing for efficient key-lock relationships management and privacy protection, enabling secure and convenient entity authentication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional master keys are used to access multiple locks, then convenience is improved, but security is worsened due to delegation risks and vulnerability to intruders

Engineering Contradiction:

Improveconvenience of accessing multiple locksVSAvoidsecurity against intruders and insiders

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The master key's access rights are segmented into individual key-lock pairs stored in a database. Instead of one physical master key, the system divides access permissions into discrete units that can be independently managed, revoked, and traced.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A centralized authentication server acts as an intermediary between keys and locks. The server mediates all authentication requests, verifying credentials and granting access without exposing the actual key materials, thereby enhancing security while maintaining convenience.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple access tokens are used for different locks, then security is improved, but device complexity is worsened due to managing multiple tokens

Engineering Contradiction:

Improvesecurity through individual key-lock pairsVSAvoidmanagement of multiple access tokens

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A single access token (such as a smart card or mobile device) is designed to perform multiple functions by storing multiple cryptographic credentials. The token can authenticate to different locks seamlessly, eliminating the need for users to physically manage multiple separate tokens.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Instead of requiring physical copies of multiple keys, the system uses digital copies of key credentials stored in electronic form within a single token. These digital credentials can be replicated, updated, and managed remotely without physical distribution.

Inventive Principle:

Principle #26Copying

3Reliability

If traditional master keys are revoked, then security is improved, but loss of time is worsened due to costly replacement of locks and keys

Engineering Contradiction:

Improverevocation of compromised accessVSAvoidtime and cost of replacing locks and keys

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

When a master key is compromised, the system discards only the specific credential associated with that key in the database, rather than replacing physical locks and keys. The revocation is accomplished by invalidating the cryptographic credential, which can be done instantly and remotely.

Inventive Principle:

Principle #34Discarding and recovering

Solution Approach 2:

The centralized authentication server enables rapid revocation by updating its database to reject credentials from compromised keys. This intermediary approach allows selective revocation without physical intervention at each lock location, dramatically reducing time and cost.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Ease of operation

If delegation of master key is allowed, then ease of operation is improved, but object-generated harmful factors are worsened due to unauthorized access risks

Engineering Contradiction:

Improvedelegation of access to othersVSAvoidunauthorized access and malicious insider threats

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

Delegation is implemented by creating separate, segmented credentials for each authorized user rather than sharing a single master key. Each delegated credential is independently traceable and can be individually revoked, preventing unauthorized access while maintaining ease of delegation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system implements audit trails and logging that provide feedback on authentication attempts and credential usage. This allows monitoring of delegated access, detection of suspicious activities, and accountability, thereby mitigating unauthorized access risks while maintaining delegation functionality.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8966252B2Private entity authentication for pervasive computing environments

Publication Date: 2015.02.24 BOARD OF TRUSTEES OPERATING MICHIGAN STATE UNIV

AI summary

A method is provided for authenticating an entity having a plurality of keys in a digital form residing on a claimant computing device. The method comprises: generating a first code word by applying a hash function to a first key residing on the claimant computing device; encoding the first code word into an array of bits having a Bloom filter format; generating a second code word by applying a hash function to a second key residing on the claimant computing device; encoding the second code word into the array of bits; and broadcasting an authentication message having the array of bits therein from the claimant computing device.