Mutual Authentication Using Encrypted Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password-based authentication schemes for web-based applications are susceptible to various attacks, including man-in-the-middle attacks, sniffing, and phishing, due to the transmission of passwords in clear text and the use of insecure cookie-based authentication methods.
Innovation Solution
A password-based mutual authentication scheme that uses an encrypted key exchange protocol, where both the browser and server generate public keys and symmetrically encrypt them using a shared secret derived from the user password, ensuring that only authenticated parties share the same secret key for subsequent communications, and employs a session signing key for authentication tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional password-based authentication schemes are used, then ease of operation is improved, but security against network-level attacks deteriorates
Solution Approach 1:
The patent introduces an intermediary key exchange mechanism between the browser and server. Instead of directly transmitting passwords, the system uses encrypted public keys and session signing keys as intermediaries to establish secure communication. The browser receives an encrypted server public key, decrypts it using the password, and then uses this key to encrypt subsequent communications, preventing direct password transmission and enabling secure authentication without exposing credentials to network eavesdropping.
2Ease of operation
If clear text password transmission is used, then ease of operation is improved, but reliability deteriorates
Solution Approach 1:
The patent replaces the mechanical transmission of clear text passwords with a cryptographic substitution system. The server sends an encrypted public key instead of the password, and the browser uses this encrypted key to secure subsequent communications. This substitution eliminates the need for clear text transmission while maintaining authentication functionality, as the encrypted key serves as a secure intermediary that derives the same session key as the original password would.
3Object-affected harmful factors
If multiple countermeasures are implemented at various layers, then security against multiple attack trajectories is improved, but device complexity deteriorates
Solution Approach 1:
The patent merges multiple security functions into a unified key exchange protocol. Instead of implementing separate countermeasures at different layers (password protection, session management, request verification), the system combines these functions into a single integrated mechanism using encrypted public keys and session signing keys. This unified approach provides protection against multiple attack trajectories while reducing overall system complexity by eliminating redundant security layers.
Data Source
AI summary
Implementations of the present disclosure are directed to web-based authentication. Implementations include receiving user credentials at a browser, transmitting a first request to an application, the first request including a first user credential, receiving a first response, the first response including an encrypted server public key (SPK) and a user-specific salt value, decrypting the encrypted SPK to provide a SPK, the encrypted SPK being decrypted based on the user-specific salt value and a second user credential, determining a browser public key (BPK) and a client-side session signing key (SSK), encrypting the BPK to provide an encrypted BPK, transmitting a second request to the application, the second request including the encrypted BPK and a request signature, the request signature having been provided based on the client-side SSK, and receiving a second response, the second response including a response signature and indicating that a user has been authenticated by the application.