NVR Authentication Using Terminal Unique Index Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network video recorders (NVRs) are vulnerable to image sniffing on network links, particularly when a single vulnerable line's key is leaked, compromising security and risking exposure of remaining lines.
Innovation Solution
A security authentication method for NVRs that assigns a terminal unique index to each pseudo-random function in a pseudo-random function set using terminal information, generates an independent private key for message authentication, and uses a session key with a predetermined expiry time to authenticate messages, ensuring secure communication even if one line is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single key is used for authentication across all communication lines, then the authentication process is simple, but security is compromised if one line is vulnerable
Solution Approach 1:
The patent divides the authentication key into multiple independent parts by assigning a unique index to each communication line. Instead of using a single shared key, each line has its own key derived from the unique index, so that compromise of one line does not affect others. This segmentation resolves the contradiction by maintaining simple authentication process while improving security through distribution.
Solution Approach 2:
The patent applies local quality by making each communication line have distinct authentication properties through unique indices. Each line's authentication key is locally generated based on its unique index, creating differentiated security characteristics for each line while maintaining overall system simplicity.
2Reliability
If multiple keys are used for each communication line, then security is improved, but the complexity of key management increases
Solution Approach 1:
The patent uses a universal authentication mechanism where a single authentication server manages all lines through a unified process. The server generates unique indices for each line and distributes authentication information centrally, allowing multiple lines to share the same authentication infrastructure without requiring separate key management systems for each line.
Solution Approach 2:
The authentication server acts as an intermediary that centralizes key management. Instead of each communication line managing its own key independently, the server mediates by generating unique indices and distributing authentication information, thereby reducing the complexity at individual line level while maintaining security.
3Productivity
If fingerprint data is stored centrally in the management server, then user authentication is efficient, but security risk increases if the server is compromised
Solution Approach 1:
The patent extracts sensitive authentication data from the central management server and distributes it to individual communication lines through unique indices. Instead of storing all fingerprint data centrally, the system extracts and stores only the necessary unique index information at each line, reducing the impact of potential server compromise.
Solution Approach 2:
The patent segments the authentication data by separating the unique index (stored at each line) from the actual fingerprint data (stored at the server but accessed through the segmented index). This segmentation limits the exposure scope - if the server is compromised, only the index mappings are exposed, not the actual biometric data.
Data Source
AI summary
Provided is a security authentication method of a network video recorder (NVR) including assigning a terminal unique index to each of pseudo-random functions included in a pseudo-random function set using terminal information; transmitting a session key having a predetermined expiry time and the pseudo-random function set with the assigned terminal unique index to a terminal; calculating a first terminal unique index for authenticating a first message using a predetermined bitstream of the first message received from the terminal; selecting a first pseudo-random function for authenticating the first message using the calculated first terminal unique index; generating a first independent private key of the terminal for authenticating the first message by inputting the session key and a MAC address of the terminal to the first pseudo-random function; and generating a message authentication code for the first message using the first independent private key and authenticating the first message.