Residue-Based Authentication for SSL MITM Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure communication, such as SSL encrypted communication using RSA public-key cryptography, are vulnerable to man-in-the-middle (MITM) attacks, especially when using short passwords, and lack effective, inexpensive measures to prevent such attacks.
Innovation Solution
An encryption apparatus that receives a public key, calculates a residue by adding or subtracting a portion of a password to the dividend data, and transmits this residue as encrypted data, making it difficult for attackers to deduce the password, even if they intercept the communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encrypted communication using RSA public-key cryptography is used, then encrypted communication is achieved, but vulnerability to MITM attacks increases when using short passwords
Solution Approach 1:
The patent applies preliminary action by performing password-based residue calculation on encrypted data before transmission. The encryption apparatus calculates a residue of encrypted data by a password held in advance by both communication parties, thereby embedding authentication capability into the encryption process itself. This preliminary authentication step prevents MITM attacks by verifying the other party's identity before actual data transmission begins.
Solution Approach 2:
The patent introduces a residue calculation mechanism as an intermediary between encryption and transmission. This residue, derived from encrypted data through password-based modular arithmetic, serves as an authentication token that verifies the counterparty's identity without exposing the password or encrypted data, thus mediating secure authentication in public-key infrastructure.
2Reliability
If long cryptographic passwords are used to prevent MITM attacks, then security is improved, but memorability for ordinary persons deteriorates
Solution Approach 1:
The patent applies partial action by using only a portion of the encrypted data (the residue after modular operation) for authentication purposes rather than requiring the entire encrypted data set or a full-length cryptographic password. This residue, calculated as encrypted_data mod password, provides sufficient authentication capability while allowing users to employ shorter, more memorable passwords.
Solution Approach 2:
The patent transforms the authentication parameter from requiring full cryptographic password strength to requiring only sufficient password strength to generate a unique residue value. By changing the authentication parameter from the password itself to its mathematical transformation (the residue), the system accepts shorter passwords while maintaining security through the one-way nature of modular arithmetic operations.
3Reliability
If EV certificates are used to augment automatic check, then security against MITM attacks is improved, but cost increases and essential problem remains unsolved
Solution Approach 1:
The patent replaces expensive EV certificates with a low-cost authentication mechanism based on residue calculation. Instead of relying on costly certificate infrastructure, the system uses inexpensive password-based modular arithmetic operations that can be performed by any communication party without requiring external certification authorities or expensive security infrastructure.
Solution Approach 2:
The patent enables self-service authentication where communication parties verify each other's identity through mutual residue calculation using passwords they already possess. This eliminates the need for external certification services, reducing dependency on expensive third-party infrastructure while maintaining authentication capability through self-contained cryptographic operations.
Data Source
AI summary
In order to protect SSL encrypted communication from MITM attacks, a server certificate is used in the communication. However, operation of the server certificate is not simple, and the certificate is not sufficient to protect the communication from the MITM attacks. In SSL encrypted communication in which a password is shared between a client and a server, the client encrypts random number data and a password by means of a public key, determines a value by processing encrypted data by means of encrypted password data, and transfers the thus-determined value to the server. The server eliminates the password encrypted data from the value and back calculates the random number data, which are then decrypted, to thus acquire the random number data generated by the client. A hash value of the random number data is submitted to the client.