Random Skew Authentication for Cryptographic Device Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication token systems are vulnerable to compromise, as adversaries can generate valid passcodes using stolen record files without needing to phish multiple login sessions, as the key updates can be compromised without detection.
Innovation Solution
Introducing a random skew between secret values used by authentication tokens and servers, where the server stores an alternative version of the secret value, requiring an adversary to obtain additional information from multiple sessions to impersonate a user, by using a protocol that determines the actual secret value based on the alternative version.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication token systems store the actual secret value (key) in the record file, then the authentication system can verify passcodes efficiently, but the system becomes vulnerable to compromise where adversaries can generate valid passcodes using stolen record files
Solution Approach 1:
The patent transforms the secret value storage by applying a random skew transformation. Instead of storing the actual secret value directly, the system stores a transformed version (secret value plus random skew). This parameter change ensures that even if the stored value is compromised, the actual secret value remains protected because the adversary cannot determine the original secret value without knowing the random skew.
Solution Approach 2:
The random skew acts as an intermediary layer between the stored value and the actual secret value. The server determines the actual secret value by combining the stored alternative version with the random skew during authentication. This intermediary prevents direct access to the secret value while enabling efficient authentication verification.
2Productivity
If the server stores the actual secret value for efficient verification, then authentication can be performed quickly, but key updates can be compromised without detection
Solution Approach 1:
The system maintains fast authentication by storing a transformed parameter (alternative version with random skew) that can be efficiently used for verification. When key updates are needed, the server can update the stored alternative version without exposing the actual secret value, preventing undetected compromises while maintaining verification speed.
3Object-affected harmful factors
If adversaries obtain the actual secret value from stolen record files, then they can generate valid passcodes immediately, but requiring multiple phishing sessions increases the difficulty of impersonation
Solution Approach 1:
By storing the transformed secret value (with random skew) instead of the actual secret value, the patent ensures that stolen record files contain useless information. Adversaries cannot generate valid passcodes from the stolen data alone because they lack the random skew component needed to determine the actual secret value, thereby preventing immediate compromise while maintaining system functionality.
Data Source
AI summary
A first cryptographic device is authenticated by a second cryptographic device. The second cryptographic device stores an alternative version of a secret value associated with the first cryptographic device as a countermeasure to compromise of the secret value. In conjunction with a protocol carried out between the first cryptographic device and the second cryptographic device, the second cryptographic device determines the secret value based at least in part on the alternative version of the secret value, and utilizes the determined secret value to authenticate the first cryptographic device. The alternative version of the secret value may comprise a randomly-skewed version of the secret value. For example, the secret value may comprise a key or other parameter of the first cryptographic device and the alternative version of the secret value may comprise a randomly-skewed version of the key or other parameter.