Mobile Device Authentication via Server-Side Credential Regeneration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic authentication techniques are difficult for application developers to implement on mobile devices and lack effective protection against adversaries who capture the device, especially due to vulnerabilities in password-based encryption methods.
Innovation Solution
The use of a prover black-box and verifier black-box system that regenerates a credential from a PIN and protocredential, providing cryptographic authentication without storing sensitive information on the device, thus enhancing security and simplifying implementation for developers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic authentication is implemented using traditional methods with private keys stored on mobile devices, then authentication security is improved, but device complexity and implementation difficulty increase significantly
Solution Approach 1:
The patent introduces a server as an intermediary that performs cryptographic operations on behalf of mobile devices. The server acts as a mediator between the user and the authentication system, handling complex cryptographic protocols, key management, and authentication logic. This allows mobile devices to use simple passwords while the server handles the complex cryptographic authentication in the background, resolving the contradiction between security and implementation complexity.
2Ease of operation
If passwords are used for authentication on mobile devices, then ease of operation is improved, but security against phishing and shoulder surfing attacks deteriorates
Solution Approach 1:
The patent creates a copy of the password authentication process that occurs on the server rather than on the mobile device. The actual password entry happens on the device (maintaining ease of operation), but the cryptographic verification and authentication logic are copied to and executed on the server. This allows the use of simple passwords while protecting against shoulder surfing since the password characters are not displayed or processed on the device in a vulnerable manner.
3Reliability
If private keys are stored on mobile devices for cryptographic authentication, then authentication capability is improved, but vulnerability to device capture and theft increases
Solution Approach 1:
The patent extracts the private key storage and management functionality from the mobile device and relocates it to a secure server environment. The mobile device retains only the ability to enter passwords and receive authentication tokens. By taking out the sensitive cryptographic materials from the vulnerable mobile device environment and placing them in a controlled server environment, the system maintains authentication capability while eliminating the risk associated with storing private keys on potentially lost or stolen devices.
4Ease of manufacture
If traditional password encryption methods are used on mobile devices, then ease of implementation is improved, but security against offline dictionary attacks deteriorates
Solution Approach 1:
The server acts as an intermediary that implements robust password hashing and encryption techniques that would be difficult to implement correctly on mobile devices. The server performs secure password storage using industry-standard cryptographic methods, including salting and iterative hashing, which protect against offline dictionary attacks. This allows the system to achieve high security without requiring mobile device developers to implement complex cryptographic protection mechanisms.
Data Source
AI summary
A method of authenticating a computing device to a back-end subsystem. In one embodiment a prover black-box in the computing device regenerates a credential containing a key pair from a PIN and a protocredential, and authenticates cryptographically to a verifier black-box in the back-end subsystem; then the verifier black-box sends an authentication token to the prover black-box as verifiable confirmation of the cryptographic authentication, the prover black-box sends the authentication token to an application front-end in the computing device, the application front-end sends the authentication token to an application back-end in the back-end subsystem, and the application back-end verifies the authentication token.