Privacy-Preserving Public Key Authentication for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public key authentication protocols in access control systems fail to protect the identity of one party from both passive and active attacks, particularly in scenarios involving access readers, leading to potential privacy breaches.
Innovation Solution
Implement a privacy-strengthened authentication mechanism using a privacy key pair and ephemeral key pairs, established through a group generator, to compute a shared session key for secure communication, ensuring that sensitive information is not compromised by attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional public key authentication protocols are used, then authentication functionality is provided, but user identity privacy is compromised against passive and active attacks
Solution Approach 1:
The authentication protocol is segmented into distinct phases: key pair generation, certificate creation, and authentication exchange. The identity information is segmented from the authentication proof, allowing verification without revealing the actual identity. The private key is segmented into components that can prove authenticity without exposing the identity itself.
Solution Approach 2:
A certificate authority (CA) acts as an intermediary that issues certificates binding identities to public keys. During authentication, the protocol uses intermediate cryptographic proofs (signatures and key exchange messages) that verify identity without directly exposing it. The shared secret acts as an intermediary that enables secure communication without revealing party identities.
2Loss of information
If additional privacy protection mechanisms are implemented, then user identity privacy is protected, but protocol complexity increases
Solution Approach 1:
The privacy protection mechanisms are established in advance through key pair generation and certificate issuance. The private key and certificate are prepared beforehand, containing all necessary information for privacy-preserving authentication. This preliminary setup eliminates the need for complex runtime privacy protection logic during the authentication exchange.
Solution Approach 2:
The protocol changes cryptographic parameters dynamically: using ephemeral keys for each session, transforming the static certificate into dynamic authentication proofs, and deriving shared secrets that change per interaction. This parameter transformation allows the same underlying mechanism to provide both security and privacy without requiring entirely separate complex protocols.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for communicating with an access control system preserving privacy are provided. The methods and systems establish, between a first device and a second device, a privacy key pair using a group generator, the privacy key pair comprising a privacy public key and a privacy private key, and compute, by the first and second devices, ephemeral key pairs based on the privacy key pair. The methods and systems establish a shared session key based on the ephemeral key pairs and transmit, by the first device to the second device, a message comprising a certificate of the first device using the shared session key that has been established based on the ephemeral key pairs.