Mobile Security Processor Perpetual Device Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for mobile devices lack a convenient and effective method for perpetual identification of a mobile device or its user, which is essential for non-repudiation in communications involving mobile applications, operating systems, and IoT devices.
Innovation Solution
The security-dedicated processor of a mobile device is programmed to enable perpetual identification by generating a long-term identity key pair, which includes a public and private key. This key pair is used to create digital signatures that can be verified by a server, ensuring that the device or user is uniquely identified across multiple apps and devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated security processor is used for one-time identification, then security is improved, but the ability to provide perpetual identification across multiple sessions is lost
Solution Approach 1:
The system performs preliminary authentication to establish a long-term identifier that persists across multiple sessions. The security processor generates cryptographic key pairs in advance, and the server stores public keys before subsequent communications, eliminating the need for repeated full authentication while maintaining security.
Solution Approach 2:
The patent introduces a server as an intermediary that stores public keys and verifies digital signatures. This mediator enables the security processor to provide perpetual identification by storing authentication credentials on the server, allowing the device to be identified across multiple sessions without repeatedly exposing private keys.
2Speed
If session tokens are cached and repeatedly called, then authentication speed is improved, but system efficiency deteriorates due to unnecessary repeated operations
Solution Approach 1:
The patent extracts the essential authentication element (public key) from the temporary session token and stores it persistently on the server. This eliminates the need to cache and repeatedly call session tokens, as the public key can be reused indefinitely for identification while the private key remains secure in the hardware processor.
3Ease of operation
If credentials are exfiltrated from a device, then unauthorized access is enabled, but the chain of trust is broken
Solution Approach 1:
The patent extracts the private key from the communication flow and confines it entirely within the secure hardware processor. Only public keys and digital signatures leave the device, making credential exfiltration impossible while maintaining ease of operation through seamless authentication.
Solution Approach 2:
The patent replaces traditional credential-based authentication (which relies on transmitting secrets) with public key infrastructure. Instead of transmitting passwords or tokens that can be intercepted, the system uses cryptographic signatures that verify identity without exposing secret materials, substituting a mechanical transmission system with a mathematical verification system.
Data Source
AI summary
In one embodiment, the present disclosure is directed to a system for digital authentication. A device includes a second processor for security functionality. The second processor generates a public key and a private key, and uses the private key and to-be-signed signature data to generate digital signatures. The device transmits the public key and a first digital signature to the server. As part of subsequent communication, the device transmits the public key and a second digital signature to the server. Using the public key, the server validates the second digital signature to verify that the second digital signature is from the device or a user of the device, thereby verifying that the subsequent communication is from the device or the user of the device.