Secret Sharing Onboarding Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication methods are vulnerable to phishing, man-in-the-browser, and man-in-the-middle attacks, and require user-supplied input, which can compromise network security during the onboarding process of electronic devices.
Innovation Solution
Implementing a secret sharing-based two-factor authentication system using a (k, n) threshold scheme, where electronic devices provide a digital certificate as one factor and part keys as the second factor, allowing the network switch to reconstruct a secret for secure onboarding without relying on user input, utilizing a polynomial function to distribute and reconstruct the secret among connected devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication is implemented, then security is improved, but vulnerability to phishing and man-in-the-middle attacks increases
Solution Approach 1:
The patent segments the authentication secret into multiple parts (first part, second part, third part) that are distributed to different network devices. No single device holds the complete secret, making it resistant to phishing and man-in-the-middle attacks because an attacker would need to compromise multiple devices simultaneously to obtain all parts needed for authentication.
2Reliability
If user-supplied input is required for authentication, then ease of operation is reduced, but security control is improved
Solution Approach 1:
The network devices automatically perform authentication using pre-configured secret parts without requiring user input. The first network device autonomously generates authentication data using its first part of the secret, and other devices verify it using their respective parts, eliminating the need for manual user involvement in the authentication process.
3Reliability
If secret sharing is implemented, then security against attacks is improved, but device complexity increases
Solution Approach 1:
The patent introduces a key server as an intermediary that facilitates the secret sharing mechanism. The key server generates and distributes secret parts to network devices and manages the authentication process by collecting verification data. This intermediary approach simplifies the overall system architecture compared to peer-to-peer secret sharing, as the key server handles the complex coordination and cryptographic operations.
Data Source
AI summary
A technique includes receiving a request from a first electronic device to connect to a network and receiving a first part from the first electronic device. The technique includes regulating onboarding of the first electronic device. Regulating the onboarding includes authenticating the first electronic device. Authenticating the first electronic device includes communicating with a plurality of electronic devices that are connected to the network to receive a set of second secret parts; constructing a first secret from the first secret part and the set of second secret parts; and comparing the first secret to a second secret. Regulating the onboarding of the first electronic device includes allowing the first electronic device to connect to the network based on a result of the comparison.