Protected Access Credential Generation Using Base Cryptographic Seed

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current network security solutions require computation-intensive and costly digital certificate exchanges for secure authentication, which can be inefficient and vulnerable to security concerns like frequent key rotations and synchronization issues.

Innovation Solution

Generating protected access credentials using a securely distributed base cryptographic seed, which is combined with hashed message authentication code to create a master key for secure authentication, reducing reliance on shared master keys and enhancing security through semi-autonomous operation of network access servers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital certificates are used for secure authentication, then authentication security is improved, but computational overhead and cost increase

Engineering Contradiction:
Improveauthentication securityVSAvoidcomputational overhead
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts the critical security function from complex digital certificate exchanges and implements it through a simplified shared secret mechanism. The core authentication capability is separated from the computationally intensive certificate validation process, allowing secure authentication with reduced computational overhead.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent employs short-lived shared secrets that are frequently rotated rather than relying on long-valid digital certificates. These disposable secrets provide sufficient security for their brief usage period while avoiding the computational cost of certificate management, aligning with the principle of using inexpensive, short-term cryptographic elements.

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

2Productivity

If shared master keys are used for authentication, then authentication efficiency is improved, but security vulnerability increases due to frequent key rotations and synchronization issues

Engineering Contradiction:
Improveauthentication efficiencyVSAvoidsecurity vulnerability
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent segments the authentication system into semi-autonomous network access servers that each maintain their own shared secrets with the authentication server. This segmentation eliminates the single point of failure represented by a centralized master key, allowing independent key management at each server while maintaining authentication efficiency.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements dynamic key management where shared secrets are periodically rotated and independently managed at each network access server. This dynamic approach allows the system to adapt to security requirements without requiring synchronization of a single master key across all servers, reducing vulnerability while maintaining efficiency.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentUS8452963B2Generating protected access credentials
Publication Date: 2013.05.28 CISCO TECHNOLOGY INC
  • US8452963B2 patent drawing
  • US8452963B2 patent drawing
  • US8452963B2 patent drawing

AI summary

A computer-implemented process comprises receiving, at a first computer, a base cryptographic seed through a secure connection to a second computer; generating one or more protected access credential parameters; combining said base cryptographic seed with at least a portion of said generated protected access credential parameters using a hashed message authentication code function to generate a master key; encrypting at least a portion of said generated protected access credential parameters using at least a portion of said generated master key; incorporating said encrypted protected access credential parameters and at least a portion of said generated protected access credential parameters into a protected access credential. In an embodiment, a master server securely distributes the seed and the process is performed by a plurality of access servers to separately generate the same master key for use in subsequent authentication communications using an authentication protocol such as EAP-FAST.