Multi-Connection Authentication via Challenge Responses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic signature systems are vulnerable to attackers who obtain certificates or access client devices, lacking robust authentication mechanisms to ensure the identity of entities across multiple connections.
Innovation Solution
A system that establishes multiple connections between a computer system and a client device, using challenge responses generated based on a shared private key to authenticate information, with public key verification and identity confirmation across these connections, ensuring that information is from the same entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates are used to create secure connections, then connection security is improved, but the system remains vulnerable to attackers who obtain certificates or access client devices
Solution Approach 1:
The authentication process is segmented into multiple independent challenge-response exchanges across multiple connections. Instead of relying on a single certificate-based connection, the system performs separate authentication challenges over different connections (including potentially untrusted ones), requiring the attacker to compromise multiple connections simultaneously rather than a single point of failure.
Solution Approach 2:
The system introduces an intermediary verification mechanism where the server acts as a mediator to verify that multiple challenge responses originate from the same entity. The server collects challenge responses from multiple connections and uses verification logic to determine if they all authenticate to the same private key, adding a layer of indirection that prevents direct certificate theft from compromising the system.
2Reliability
If multiple connections are used for authentication, then authentication robustness is improved, but system complexity increases
Solution Approach 1:
The authentication subsystem is designed to handle multiple connection types and protocols universally. The same challenge-response mechanism works across different connections (secure and untrusted), and the verification logic remains consistent regardless of the connection medium, reducing the need for connection-specific authentication code.
Solution Approach 2:
The client device autonomously manages multiple connections and generates challenge responses for each connection independently using its private key. The client does not require complex coordination logic to manage multiple connections - it simply responds to authentication challenges on each connection using the same cryptographic credentials, allowing the system to self-organize the multi-connection authentication process.
Data Source
AI summary
In certain embodiments, first and second challenge responses may be obtained at a computer system from a client device respectively via first and second connections between the computer system and the client device. The challenge responses may each be generated based on a same private key stored in a secure local storage at the client device. Confirmation of identification information associated with an entity, to which the private key corresponds, may be obtained based on information obtained from the client device via the first connection. Information obtained from the client device via the second connection may be authenticated based on (i) the obtained confirmation via the first connection and (ii) verification of the first and second challenge responses obtained respectively via the first and second connections.