Mutual Authentication Key Exchange Using Counter-Based Pseudo-Random Numbers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems face challenges in providing fast and secure identity verification, particularly in secure messaging between devices, where key exchanges are not adequately scripted and may stress non-volatile memory with counter updates.
Innovation Solution
A method involving the generation and exchange of predictable random numbers, using pseudo-random functions or counters, to establish encryption keys for secure messaging, reducing the need for counter updates and enhancing security and privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key exchange methods are used for device authentication, then security can be maintained through established protocols, but the authentication process becomes complex and slower
Solution Approach 1:
The patent changes the fundamental parameters of key exchange by using counter-based pseudo-random number generation instead of traditional random number exchange. This transforms the key derivation process into a deterministic function of shared secrets and counters, simplifying the protocol while maintaining security through mathematical properties of hash functions and counter uniqueness.
Solution Approach 2:
The patent extracts and eliminates the need for random number generation and exchange from the authentication protocol. By removing this complex component and replacing it with counter-based derivation, the system reduces protocol complexity and potential attack vectors while preserving security through the hardness of deriving shared secrets from the exchanged data.
2Reliability
If random numbers are used for key generation, then security is enhanced through unpredictability, but memory resources are consumed for storing counters and managing random number generation
Solution Approach 1:
The patent implements self-service by having each device independently generate the same pseudo-random key stream using only the shared secret and its own counter values. No device needs to store or transmit random numbers, and no external random number source is required. The system serves its own key generation needs through deterministic derivation, eliminating memory overhead for random number storage.
Solution Approach 2:
The patent performs preliminary action by pre-establishing shared secrets between devices before authentication. These shared secrets serve as the foundation for all subsequent key derivations, eliminating the need for runtime random number generation and storage. The counters are incrementally updated and reused, preventing memory accumulation while maintaining security through the one-way nature of the derivation function.
3Productivity
If fast authentication is implemented through simplified protocols, then speed is improved, but security vulnerabilities may increase due to reduced complexity
Solution Approach 1:
The patent segments the authentication process into distinct phases: shared secret establishment, counter initialization, pseudo-random key derivation, and authentication message exchange. Each segment uses simple, deterministic operations that are computationally efficient, yet the composition of these segments provides robust security through multiple layers of cryptographic protection and counter-based uniqueness guarantees.
Data Source
AI summary
A verifier device of an authentication system comprises physical layer circuitry and processing circuitry coupled to the physical layer circuitry. The processing circuitry is configured to encode an authentication command for sending to a credential device; decode a response communication received from the credential device, wherein the response communication includes a first random number; encrypt the first random number, a second random number, and verifier keying material for sending to the credential device; decrypt encrypted information received from the credential device, wherein the encrypted information includes the first random number, the second random number, and receiver keying material; and calculate a session encryption key using the verifier keying material and the receiver keying material.