Password-Authenticated Key Exchange for Secure Device Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication protocols often require certificate authorities for authentication, which can be impractical for devices with limited computing capabilities, such as remote controls or IoT devices, and may not include native pre-shared key (PSK) support, limiting their ability to establish encrypted and authenticated connections.
Innovation Solution
Implementing a password-authenticated key exchange (PAKE) protocol, like JPAKE, in conjunction with existing protocols like TLS, allowing devices to authenticate using a shared password transmitted via an alternate medium, such as a display or ultrasonic signal, to generate a symmetric key for secure communication without relying on certificate authorities or native PSK support.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate authorities are used for authentication, then security is improved, but device complexity and computational requirements increase
Solution Approach 1:
The patent extracts the authentication mechanism from the traditional certificate authority model and implements a standalone password-authenticated key exchange protocol. This allows devices to authenticate each other directly using shared passwords without requiring external certificate authorities, thereby reducing device complexity while maintaining security through the PAKE protocol's cryptographic mechanisms
Solution Approach 2:
The patent introduces an intermediary approach by using a shared password as the basis for key exchange. Instead of directly using certificate authorities or pre-shared keys, the system uses the password to authenticate and derive session keys through the PAKE protocol, creating a balanced authentication mechanism that works well for resource-constrained devices
2Ease of operation
If native pre-shared key support is implemented, then encrypted connection establishment is improved, but device capability requirements increase
Solution Approach 1:
The patent changes the authentication parameter from requiring native pre-shared key support to using password-authenticated key exchange. This parameter change allows devices with limited capabilities to establish encrypted connections by using the PAKE protocol, which derives cryptographic keys from passwords through a standardized process rather than requiring native PSK implementation
3Ease of operation
If password authentication is used, then usability for limited-capability devices is improved, but authentication security may be compromised
Solution Approach 1:
The patent applies preliminary action by having devices establish a password-authenticated channel before exchanging sensitive information. The PAKE protocol performs preliminary authentication and key derivation, ensuring that subsequent communications are securely protected. This preliminary security establishment maintains authentication security while using simple password-based authentication
Data Source
AI summary
Various examples are directed to systems and methods for establishing a secure, authenticated connection between devices utilizing a password authenticated key exchange. A client may send an encrypted connection request message to a server via a first communication medium. The server may send the client first data token data via a first communication medium. The client may encrypt the first data token with a password-authenticated key, for example, obtained in a password authenticated key exchange with the server. The client may encrypt the first token data based at least in part on the password-authenticated key to generate a message authentication code (MAC). The client may send the MAC to the server.