Rotating Key Authentication for Third-Party Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for third-party access to network systems are vulnerable to token hijacking, allowing unauthorized entities to gain access, as the network system cannot verify the identity of third-party entities with certainty.
Innovation Solution
Implementing a system that uses session tokens with a time-out period and rotating keys, where each request and response pair generates a new rotating key, requiring the third-party entity to authenticate with both the session token and rotating key for each interaction, and revoking the rotating key after successful authentication to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional token authentication is used for third-party access, then ease of operation is improved, but reliability deteriorates due to token hijacking vulnerabilities
Solution Approach 1:
The patent implements dynamic authentication by generating a new rotating key for each interaction between the third-party entity and the network system. Unlike static tokens, these rotating keys are temporary and change with each session, making the authentication mechanism adaptive and resistant to hijacking while maintaining operational ease through automated key management.
Solution Approach 2:
The intermediary entity performs preliminary authentication of the third-party entity before granting access to the network system. The intermediary verifies the third-party's identity and establishes a trusted relationship in advance, then uses this pre-authenticated status to facilitate subsequent interactions without requiring the third-party to re-authenticate with the network system directly.
2Reliability
If rotating keys are generated for every interaction, then reliability is improved by preventing token hijacking, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary entity that acts as a mediator between the third-party entity and the network system. The intermediary manages the complexity of generating and tracking rotating keys, storing them temporarily in its own database, and coordinating their distribution. This shifts the computational and storage burden from the network system to the intermediary, maintaining reliability while reducing overall system complexity.
Solution Approach 2:
The rotating keys are designed as short-lived, disposable authentication credentials that are generated, used once, and then discarded. Each rotating key has a limited lifetime and is invalidated after a single interaction, eliminating the need for long-term storage and complex key management infrastructure. This approach achieves high reliability through frequent key rotation while keeping the system simple by using ephemeral credentials.
3Reliability
If session tokens have predetermined time-out periods, then reliability is improved by limiting unauthorized access window, but loss of time increases due to re-authentication requirements
Solution Approach 1:
The patent implements periodic authentication through rotating keys that are generated for each interaction cycle between the third-party entity and the network system. Rather than using a single long-lived token with a time-out period, the system employs a series of short-lived rotating keys that are periodically renewed with each interaction, maintaining continuous authenticated access without long vulnerability windows.
Solution Approach 2:
The intermediary entity maintains continuous authentication state by storing and managing rotating keys in its database throughout the third-party's interaction with the network system. This allows the third-party to access the network system repeatedly without re-authenticating with the intermediary, ensuring continuous useful action while the rotating keys provide periodic security renewal with each network system interaction.
Data Source
AI summary
Systems, methods, and computer program products are provided for secure authentication of third-parties accessing a network system (e.g., a website or the like) through an intermediary entity (i.e., a trusted caller). A session token having a predetermined time-out period (i.e., an expiration time) is implemented in conjunction with a rotating key that is generated for each request and response pair associated with each call/interaction between the third-party entity and the network system. In this regard, the third-party entity must authenticate themselves each time they interact (i.e., call-in) into the network system by presenting the assigned session token and rotating key communicated in response to the previous interaction. As such hijacking of the third-party's network session with the network system is prevented by implementing tokens that expire, in unison with, encrypted rotating keys that are valid only until the next third-party call-in/interaction with the network entity.