Client-Server Mutual Authentication via Event-Based OTP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data communication protocols lack a secure method for both authentication and encryption, particularly for client-server communications, and often require a public-key infrastructure, which is not suitable for all scenarios and can be cumbersome for user authentication.
Innovation Solution
A method that generates one-time passwords (OTPs) to derive encryption keys and MAC keys for secure client-server communication, enabling mutual authentication and data encryption without relying on a public-key infrastructure, using a two-pass protocol where OTPs are used to protect and verify data integrity and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI (public-key infrastructure) is used for secure client-server communication, then data encryption and authentication security is improved, but device complexity and ease of operation deteriorate due to additional user authentication requirements and infrastructure setup
Solution Approach 1:
The patent extracts the essential security function from the complex PKI infrastructure and implements it using simplified OTP-based mechanisms. The invention removes the need for public-key certificates, trust anchors, and complex authentication workflows, retaining only the core security objectives through a lighter-weight OTP framework.
Solution Approach 2:
The patent employs disposable one-time passwords that are generated, used, and then discarded after a single authentication event. This replaces the persistent, complex PKI infrastructure with transient OTPs that provide sufficient security for the communication session without requiring long-term certificate management or infrastructure maintenance.
2Ease of operation
If OTPs are used for user authentication, then ease of operation is improved, but adaptability for data encryption deteriorates as OTPs are not generally suitable for encryption purposes
Solution Approach 1:
The patent extends the OTP framework from its traditional single-purpose authentication function to a multi-functional system that also handles data encryption. By deriving both encryption keys and MAC keys from the OTP, the system enables OTPs to serve multiple security purposes: authentication, encryption, and integrity verification, thereby achieving universality across different security operations.
3Ease of operation
If a secure protocol based on OTP framework is implemented, then ease of operation is improved, but reliability for mutual authentication and encryption deteriorates without additional authentication steps
Solution Approach 1:
The patent merges multiple security functions into a unified OTP-based protocol. Instead of separating authentication, encryption, and integrity verification into distinct mechanisms, the invention combines all these functions by deriving multiple keys (encryption key and MAC key) from a single OTP, thereby achieving mutual authentication and data protection through a streamlined process without requiring additional separate authentication steps.
Data Source
AI summary
A method of authenticating and encrypting a client-server communication is provided. Two one-time passwords (OTP1 and OTP2) are generated from a cryptographic token. An encryption key (K_ENC) and a MAC key (K_MAC) are generated based on OTP2. The client data are prepared and protected using K_ENC and K_MAC. A request message is sent from the client to the server, and contains the protected client data, a cryptographic token identifier and OTP1. OTP1 is validated at the server, and OTP2 is generated at the server upon successful validation. K_ENC and K_MAC are derived from OTP2 at the server. The request message is processed and result data is generated. The result data is encrypted using K_ENC and a digest is created using K_MAC. The encrypted result data is sent to the client, and is decrypted using K_ENC and the authenticity of the result data is verified using K_MAC.