Protected Access Credential Generation Using Base Cryptographic Seed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions require computation-intensive and costly digital certificate exchanges for secure authentication, which can be inefficient and vulnerable to security concerns like frequent key rotations and synchronization issues.
Innovation Solution
Generating protected access credentials using a securely distributed base cryptographic seed, which is combined with hashed message authentication code to create a master key for secure authentication, reducing reliance on shared master keys and enhancing security through semi-autonomous operation of network access servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates are used for secure authentication, then authentication security is improved, but computational overhead and cost increase
Solution Approach 1:
The patent extracts the critical security function from complex digital certificate exchanges and implements it through a simplified shared secret mechanism. The core authentication capability is separated from the computationally intensive certificate validation process, allowing secure authentication with reduced computational overhead.
Solution Approach 2:
The patent employs short-lived shared secrets that are frequently rotated rather than relying on long-valid digital certificates. These disposable secrets provide sufficient security for their brief usage period while avoiding the computational cost of certificate management, aligning with the principle of using inexpensive, short-term cryptographic elements.
2Productivity
If shared master keys are used for authentication, then authentication efficiency is improved, but security vulnerability increases due to frequent key rotations and synchronization issues
Solution Approach 1:
The patent segments the authentication system into semi-autonomous network access servers that each maintain their own shared secrets with the authentication server. This segmentation eliminates the single point of failure represented by a centralized master key, allowing independent key management at each server while maintaining authentication efficiency.
Solution Approach 2:
The patent implements dynamic key management where shared secrets are periodically rotated and independently managed at each network access server. This dynamic approach allows the system to adapt to security requirements without requiring synchronization of a single master key across all servers, reducing vulnerability while maintaining efficiency.
Data Source
AI summary
A computer-implemented process comprises receiving, at a first computer, a base cryptographic seed through a secure connection to a second computer; generating one or more protected access credential parameters; combining said base cryptographic seed with at least a portion of said generated protected access credential parameters using a hashed message authentication code function to generate a master key; encrypting at least a portion of said generated protected access credential parameters using at least a portion of said generated master key; incorporating said encrypted protected access credential parameters and at least a portion of said generated protected access credential parameters into a protected access credential. In an embodiment, a master server securely distributes the seed and the process is performed by a plurality of access servers to separately generate the same master key for use in subsequent authentication communications using an authentication protocol such as EAP-FAST.


