Network-Bound Data Security Using Keyless HMAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-bound data security techniques for securing data on non-volatile storage media require the exchange of client-specific and server-specific keys or secrets, leading to security gaps and increased complexity, making them non-scalable and vulnerable to unauthorized access.
Innovation Solution
A novel approach using Hash-based Message Authentication Code (HMAC) generation techniques to secure data without exchanging client-specific or server-specific keys, employing a sequence of message authentication codes generated collaboratively between client and server, with the final code encrypting the security key, ensuring network-bound security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing network-bound data security techniques are used to secure data on non-volatile storage media, then data security is provided, but client-specific and server-specific keys or secrets must be exchanged between client and server, leading to security gaps and increased complexity
Solution Approach 1:
The patent extracts and eliminates the need for key exchange between client and server by using a keyless HMAC generation process. The server's secret key is extracted from the key exchange process and kept solely on the server side, while the client generates authentication codes without requiring any server-specific secrets, thus removing the security vulnerabilities and complexity associated with key exchange.
Solution Approach 2:
The patent introduces a cryptographic intermediary mechanism using HMAC (Hash-based Message Authentication Code) that mediates between the client and server without requiring direct secret sharing. The HMAC function acts as an intermediary that allows the client to generate authentication codes based on server responses without needing to know or exchange secret keys with the server.
2Reliability
If existing network-bound data security techniques are used, then data security is provided, but the techniques are non-scalable and vulnerable to unauthorized access
Solution Approach 1:
The patent creates a universal authentication mechanism where the keyless HMAC generation process can be applied across multiple clients and servers without requiring individual key exchange for each pair. The server's secret key serves multiple purposes: generating responses for different clients and enabling those clients to generate their own authentication codes, thus providing multi-functionality and scalability to the security system.
3Ease of operation
If client and server exchange secrets to secure data, then authentication is possible, but security gaps are created and processing complexity increases
Solution Approach 1:
The patent extracts the server's secret key from the authentication exchange process and keeps it exclusively on the server side. The client performs authentication by generating HMAC codes based on server responses without ever receiving or storing the server's secret key, thus eliminating security gaps while maintaining authentication capability.
Solution Approach 2:
The patent replaces the mechanical key exchange system with a cryptographic substitution using HMAC functions. Instead of physically or digitally transmitting secret keys between client and server, the system uses hash-based cryptographic functions where the client computes authentication codes based on server responses, substituting the key exchange mechanism with a mathematically secure computation process.
Data Source
AI summary
Techniques are described for securing data stored on a non-volatile storage medium from unauthorized access using improved network-bound data security techniques. The data is secured using network-bound security techniques without the entities involved in the processing (e.g., clients and servers) having to exchange any client-specific or server-specific keys, secrets, or other secret data with each other. The techniques disclosed herein provide the network-bound data security functionality using a sequence of Message Authentication Codes (macs) generated using Hash-based Message Authentication Code (HMAC) generation techniques.