Server-Side Key Exchange Using OIDC Token Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing server-assisted key exchange protocols require repeated authentication with the ID provider for each key exchange, making the process inefficient when OpenID Connect (OIDC) is applied.
Innovation Solution
A key exchange system that includes a server with a nonce generation unit and key generation units for public and secret key token control encryption, and terminals with encryption and decryption units, allowing for efficient key exchange using any authentication method without re-authentication by leveraging OIDC's token control public key encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If authentication is performed on the server every time key exchange is performed, then security is maintained, but efficiency deteriorates due to repeated authentication with the ID provider
Solution Approach 1:
The server performs authentication with the ID provider in advance before the key exchange protocol begins. The authentication result (ID token) is stored in the server's storage unit, allowing the server to use this pre-obtained authentication result during subsequent key exchange operations without repeating the authentication process with the ID provider.
Solution Approach 2:
The server creates a copy of the authentication result (ID token) obtained from the ID provider and stores it in the storage unit. This copied authentication result can then be reused during multiple key exchange sessions, eliminating the need for repeated authentication operations with the ID provider.
2Adaptability or versatility
If OIDC is applied to existing key exchange protocols, then authentication method diversity is improved, but system complexity increases due to integration requirements
Solution Approach 1:
The server is designed with a universal authentication mechanism that can handle multiple authentication methods through the OIDC framework. The server includes a nonce generation unit and key generation unit that work with the ID token from various authentication methods, allowing the same server structure to support diverse authentication approaches without requiring separate implementation for each method.
Solution Approach 2:
The server acts as an intermediary between the terminal and the ID provider. It receives the ID token from the terminal (which contains authentication information from various authentication methods), processes this information through its nonce generation and key generation units, and facilitates key exchange. This intermediary role allows the server to abstract the complexity of different authentication methods while maintaining a unified interface.
Data Source
AI summary
A hey exchange system includes a plurality of terminals that perform key exchange; and a server that performs authentication of each of the terminals and mediation of the key exchange. The server is configured to generate a nonce used when the authentication is performed between the server and the terminal by federation using OpenID Connect; generate a public key and a secret key of token control encryption; transmit the nonce and the public key to the terminal; and decrypt a ciphertext received from the terminal by using the secret key and a token received from the terminal. The terminal is configured to generate a ciphertext obtained b encrypting predetermined data by using the public key and a token generated from the nonce; and transmit the ciphertext to the server.