Mutual Device Authentication Using Ephemeral Keys Against Impersonation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods between electronic devices are vulnerable to impersonation attacks, particularly when a pre-shared mutually trusted third party is compromised, and there is a need for enhanced security to prevent unauthorized access.
Innovation Solution
A method involving a remote electronic device and a first electronic device that generates temporary private and public keys, calculates cross-stage secret keys, and uses one-way functions to establish a common secret key, along with cryptographic authentication codes to verify the possession of secret keys, ensuring secure authentication without revealing unique device information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a pre-shared mutually trusted third party is used for authentication, then authentication can be established between devices, but the system becomes vulnerable to impersonation attacks if the third party is compromised
Solution Approach 1:
The patent extracts the trusted third party from the authentication process and replaces it with direct device-to-device cryptographic verification. Each device generates and verifies cryptographic authentication codes independently, eliminating the single point of failure that the pre-shared third party represented.
Solution Approach 2:
The patent performs preliminary generation and secure storage of cryptographic authentication codes before authentication is needed. The codes are generated offline and stored in secure elements, so when authentication is required, the devices can immediately verify each other without needing to contact a third party, preventing impersonation attacks.
2Speed
If cryptographic authentication codes are transmitted online, then real-time authentication is achieved, but the risk of code leakage increases
Solution Approach 1:
The patent generates and stores cryptographic authentication codes in advance in secure elements before they are needed for authentication. This preliminary action allows the codes to be ready for immediate use without online transmission, achieving both fast authentication and code security.
Solution Approach 2:
The patent uses temporary session keys and ephemeral cryptographic parameters for each authentication session that are discarded after use. This approach minimizes the window of vulnerability for code leakage while maintaining authentication speed.
3Reliability
If direct identity authentication using cryptographic codes is implemented, then impersonation resistance is improved, but the complexity of the authentication mechanism increases
Solution Approach 1:
The patent enables devices to perform self-authentication using cryptographic codes stored in their own secure elements. Each device independently verifies the other's identity without requiring external assistance, simplifying the overall system architecture while maintaining high security against impersonation.
Solution Approach 2:
The patent introduces a standardized cryptographic verification protocol as an intermediary layer that simplifies the interaction between devices. This protocol handles the complex cryptographic operations in a unified manner, reducing implementation complexity while maintaining strong impersonation resistance.
4Reliability
If secure channels are established through traditional methods, then basic authentication is achieved, but the channels remain vulnerable to attacks even with encryption
Solution Approach 1:
The patent establishes cryptographic authentication codes and session keys before any data transmission occurs. This preliminary cryptographic setup creates a secure foundation that protects against attacks throughout the communication session, not just during the authentication phase.
Solution Approach 2:
The patent implements mutual authentication where both devices verify each other's identities and continuously validate the security of the communication channel. This feedback mechanism detects potential attacks early and allows the devices to terminate compromised sessions, maintaining channel security.
Data Source
AI summary
This disclosure relates to a first electronic device, a remote electronic device, a method of authentication between electronic devices. The method is applicable in a mutual dynamic authentication, and the method includes: initiating, by a first electronic device, registration with a remote electronic device for registering an identity belonging to the first electronic device with the remote electronic device, by: calculating a second cryptographic authentication code; and securing first information and second information from being tampered with by a middleman; wherein the first information is sent by the first electronic device to the remote electronic device, and includes a first public key and a second public key of the first electronic device; and wherein the second information is received from the remote electronic device, and the second information includes a first public key and a second public key of the remote electronic device.