Secure Device Authentication Using Dual-Key Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure communication between devices, such as electronic passports and terminals, are vulnerable to unauthorized access when the device is stolen, as security relies solely on the legitimate holder's possession, and methods like One-Time Passwords are insecure if the password is discovered.
Innovation Solution
A method that generates and verifies unique data pairs using private and public keys from both devices, with an additional third datum dependent on input and reference secret data, ensuring secure communication only if both devices' private keys are correctly matched, providing a robust two-level security system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security is based solely on device possession (MRTD chip holding), then authentication can be performed with simple device-to-device communication, but security is compromised when the device is stolen
Solution Approach 1:
The authentication mechanism is segmented into two independent levels: device possession verification (original Diffie-Hellman key agreement) and user identity verification (third datum validation). This segmentation allows each layer to address specific security requirements without compromising the other, resolving the contradiction between security reliability and mechanism complexity.
Solution Approach 2:
The patent adds a new dimension to authentication by introducing the third datum that depends on both public key and secret data. This transforms the authentication from a single-dimensional device possession check to a multi-dimensional verification process encompassing device identity, user credentials, and cryptographic proof, thereby enhancing security without overly complicating the base mechanism.
2Reliability
If One-Time Password (OTP) is used for mutual authentication, then authentication can be performed without private key exchange, but security is compromised if the password is discovered
Solution Approach 1:
The patent replaces the mechanical OTP system with a cryptographic key agreement mechanism enhanced by third datum verification. Instead of relying on pre-shared passwords that require manual entry and distribution, the system uses cryptographic key pairs and mathematical proofs, substituting a fragile mechanical authentication system with a more robust cryptographic one while maintaining operational simplicity through automated verification.
3Reliability
If both devices generate keys from their private keys and public keys respectively, then mutual authentication can be established, but the system remains vulnerable if either private key is compromised
Solution Approach 1:
The patent applies preliminary anti-action by introducing the third datum that validates the relationship between public keys and secret data before final authentication is established. This preventive measure ensures that even if private keys are compromised, the authentication cannot proceed without the corresponding valid third datum, thereby counteracting the harmful effect of key compromise in advance.
Solution Approach 2:
The third datum acts as an intermediary verification layer between the key agreement process and final authentication approval. It mediates the authentication by providing an additional validation step that confirms the legitimacy of the key pair relationship, adding a protective barrier against key compromise without disrupting the fundamental mutual authentication mechanism.
Data Source
AI summary
A method for putting a first device in secure communication with a second device. The first device generating at least one first datum dependent on a private key specific to the first device and a public key specific to the second device. The second device generating at least one second datum dependent on a private key specific to the second device associated with the second device public key, and dependent on a third datum dependent on a public datum specific to the first device. Implementing a test verifying whether the first and second data meet a predetermined condition, and putting the first device in secure communication with the second device only if the predetermined condition is met. Before generating the second datum generating the third datum so that the predetermined condition is met only if input data are identical to reference secret data associated with the second device.