Parameter-Based Key Derivation for Distributed Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing environments face challenges in balancing security and efficiency, particularly in managing shared secret credentials for authentication, as centralized systems can lead to scaling bottlenecks and availability issues when handling multiple users and services.
Innovation Solution
The implementation of a key derivation technique using Hash Message Authentication Code (HMAC) algorithms that derive artifacts from shared secret credentials, incorporating parameters such as timestamps, service identifiers, and geographic restrictions, allowing for secure authentication without exposing the actual credentials and enabling distributed key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If centralized key storage and management is used, then security control is simplified, but scalability and availability deteriorate due to bottlenecks
Solution Approach 1:
The patent segments the centralized key management system into distributed key derivation nodes that independently generate and verify signatures. Each node derives keys locally using secret credentials and parameters, eliminating the single-point bottleneck while maintaining security control through distributed architecture.
Solution Approach 2:
The patent introduces parameter-based key derivation as an intermediary mechanism between secret credentials and authentication signatures. This intermediary layer allows multiple users and services to derive unique keys without direct access to centralized key storage, improving scalability while maintaining security.
2Adaptability or versatility
If more users and services are authenticated, then system coverage is improved, but key management security and availability worsen
Solution Approach 1:
The system segments authentication coverage across multiple independent key derivation nodes, allowing unlimited users and services to be authenticated without compromising the availability of any single node. Each node operates independently, so failures in one node do not affect others.
Solution Approach 2:
Each key derivation node operates with local secret credentials and derives keys locally without requiring centralized key management. This local quality approach allows the system to scale to unlimited users and services while maintaining high availability through distributed operation.
3Productivity
If distributed key management is implemented, then scalability is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal key derivation function that can serve multiple users, services, and authentication scenarios through a single distributed architecture. The same secret credentials and parameter-based derivation mechanism work across all nodes, reducing the complexity that would otherwise arise from managing multiple specialized systems.
4Reliability
If shared secret credentials are protected, then security is improved, but access efficiency deteriorates
Solution Approach 1:
The patent extracts the authentication functionality from the shared secret credentials themselves by deriving unique keys from them through parameter-based key derivation. This allows the credentials to remain highly protected while authentication operations become efficient, as nodes derive and use only the specific keys needed for each authentication event.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method is provided. The method comprises: generating a signing key by performing at least: obtaining a key that is a shared secret between a client device and a computer system of a service; deriving, based at least in part on the shared secret and information indicating a date on which use of the signing key is to be restricted, a date key whose use is limited to the date; deriving, based at least in part on the date key and information indicating a region in which use of the signing key is to be restricted, a region key whose use is restricted to both the date and the region; and deriving, based at least in part on the region key and information indicating a service to which use of the signing key is to be restricted, a service key whose use is restricted to the date, the region, and the service; obtaining, at the computer system of the service, a canonicalized message from the client device and a first digital signature; deriving, at the computer system of the service, a second digital signature based at least in part on the canonicalized message and the signing key; and determining, at the computer system of the service, that the canonicalized message is authentic as a result of the first digital signature matching the second digital signature.