Proximity-Based Cryptographic Authorization via BLE Challenge-Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional cryptographic services systems in information handling systems are vulnerable to unauthorized access due to easy-to-compromise authentication methods, allowing malicious applications to access sensitive information.
Innovation Solution
Implementing a secure cryptographic module with Intel Software Guard Extensions (SGX) that uses a challenge-response mechanism over a local communication medium like Bluetooth Low Energy (BLE) for proximity-based authorization, requiring both user authentication and mobile device response to unlock cryptographic services, providing an additional layer of authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication methods are used for cryptographic services, then ease of operation is improved, but security reliability deteriorates allowing unauthorized access
Solution Approach 1:
The patent introduces a mobile device as an intermediary between the user and the cryptographic services. The mobile device receives challenges from the information handling system, obtains user authentication input, generates responses, and transmits them back. This intermediary layer prevents direct access to cryptographic services, thereby improving security while maintaining ease of operation through the familiar mobile device interface.
Solution Approach 2:
The system performs preliminary authentication actions before granting access to cryptographic services. The challenge-response mechanism requires the mobile device to obtain user authentication input and generate valid responses before the information handling system will authorize access to security services. This preliminary verification step ensures that only authenticated users can access cryptographic functions.
2Reliability
If proximity-based challenge-response mechanism is implemented, then security reliability is improved, but device complexity increases
Solution Approach 1:
The mobile device leverages its existing multi-functional capabilities to handle the challenge-response authentication. It uses the device's communication interfaces to receive challenges, the processing unit to generate responses, and existing authentication mechanisms to verify user input. By utilizing the mobile device's universal functionality, the system achieves enhanced security without significantly increasing overall device complexity.
3Reliability
If missed response threshold is implemented, then security reliability is improved by preventing brute force attacks, but productivity decreases due to service interruptions
Solution Approach 1:
The system implements periodic challenge transmission at defined intervals rather than continuous challenges. The missed response threshold mechanism allows a certain number of failed attempts before disabling access, creating a periodic reset opportunity. This approach balances security by preventing continuous brute force attacks while maintaining productivity by allowing legitimate users to recover service access after temporary disruptions.
Data Source
AI summary
An information handling system for proximity-based authorization for encryption and decryption services may include a local network, a first memory having a private region, and a secure cryptographic module having a communication module stored within the private region. The secure cryptographic module may, when a first timer tick occurs, transmit a first encrypted challenge to a mobile device over the local network using the communication module. The secure cryptographic module may, when a first encrypted response corresponding to the first encrypted challenge is received from the mobile device via the local network using the communication module, decrypt the first encrypted response to a first response, validate the first response based on the secure cryptographic information, and when the first response is validated, enable access to the security services for the mobile device.