Secure Client-Server Communication via Key Basis Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for establishing secure communication between a client and a server over unsecured data connections are vulnerable to man-in-the-middle attacks and do not effectively authenticate both parties without relying on third parties or complex cryptographic structures.
Innovation Solution
A method that generates a common key basis for both communication partners, using which temporary session keys are derived for secure communication, ensuring that knowledge of one partner's information is insufficient to impersonate the other, and employing checksums to detect manipulation during key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used to establish secure connection, then user identification is achieved, but the password can be read and stolen by attackers through man-in-the-middle attacks
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of transmitting or comparing passwords, the system uses public key infrastructure where only public keys and certificates are exchanged. The private key never leaves the client device, eliminating the vulnerability of password transmission while maintaining authentication security.
Solution Approach 2:
The patent introduces certificates issued by trusted Certificate Authorities as intermediaries. These certificates verify the authenticity of public keys without requiring direct password exchange. The CA-signed certificate acts as a mediator that proves identity without exposing sensitive authentication credentials.
2Reliability
If TLS/SSL protocol is used to ensure confidentiality and integrity, then secure communication is established, but no way of retracing the identity of a user is provided
Solution Approach 1:
The patent combines multiple functions into the certificate-based authentication mechanism. The same certificate that provides encryption keys for secure communication also serves as the user identity identifier. This eliminates the need for separate password or username transmissions, as the certificate subject name and other attributes directly identify the user while enabling secure communication.
3Ease of operation
If certificates are issued by any computer without centralized verification, then authentication is simplified, but a man in the middle can issue a copy of the certificate and decrypt confidential data
Solution Approach 1:
The patent introduces trusted Certificate Authorities as intermediary verification bodies. These CAs sign certificates to provide cryptographic proof of authenticity. The chain of trust from root CA to intermediate CAs to end-entity certificates creates a hierarchical verification system that prevents unauthorized certificate issuance while maintaining operational simplicity.
Solution Approach 2:
The patent implements preliminary verification through certificate validation before establishing secure communication. The client verifies the server's certificate chain against trusted root CAs before accepting the connection. This preliminary authentication prevents man-in-the-middle attacks by ensuring certificates were issued by authorized entities before any confidential data is transmitted.
4Reliability
If public and private key pairs are transmitted to end devices, then authentication capability is provided, but the keys must be securely transmitted and stored
Solution Approach 1:
The patent extracts the private key from the transmission process entirely. Only public keys embedded in certificates are transmitted to end devices. The private key remains securely stored in the client's key store and never leaves the device. This extraction eliminates the complexity of secure key transmission and storage while maintaining authentication capability.
Solution Approach 2:
The patent uses public key certificates as verifiable copies that can be freely transmitted. The public key in the certificate serves as a safe copy that enables authentication without compromising security. Multiple copies of the public key can be distributed to servers and other parties without risk, as only the private key provides authentication authority.
Data Source
Figure 1
Figure 2
AI summary
A method for establishing secure communication between a client and a server as communication partners over an unsecured data connection for data transmission comprises several steps: Generating a first key base (Sbc) on the client and a second key base (Sbs) on the server, wherein the first key base (Sbc) (client key base) includes a client base key (kDH1) and a key verification value (k2) for the server's base key, and the second key base (Sbs) (server key base) includes a server base key (kDH2) and a key verification value (k1) for the client's base key. Further steps include generating a session key (kSession) using the corresponding key base (Sbc or Sbs), with the client and server generating the same session key (kSession).Encrypting all data to be transmitted in a sender with the session key (kSession) and transmitting the data to a receiver, receiving and decrypting the data with the session key (kSession) in the receiver, whereby authentication of the respective other communication partner takes place during the generation of the key base (Sbc or Sbs) and during the generation of the session key (kSession).