Secure Session Identifiers via Message Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Websites that do not support Secure Session Layer (SSL) are vulnerable to session hijacking, allowing eavesdroppers to impersonate users, necessitating a method for remote connection authentication over an insecure channel without disclosing a shared secret.
Innovation Solution
A protocol where a server generates a sequence number and server message authentication code, which the client uses to create a client message authentication code, ensuring the integrity and validity of requests over an insecure channel by verifying the sequence number, account identifier, and message authentication codes using a shared secret key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authentication is performed over an insecure channel without SSL, then compatibility with older systems is improved, but security against session hijacking deteriorates
Solution Approach 1:
The protocol performs preliminary actions by establishing a shared secret key between client and server before authentication. The server generates a random shared secret key and transmits it to the client through a secure key exchange mechanism, preparing the cryptographic foundation needed for subsequent authentication operations over the insecure channel.
Solution Approach 2:
The patent introduces message authentication codes (MACs) as intermediary cryptographic elements that mediate the authentication process. The server computes a MAC using the shared secret key and transmits it with the authentication message, while the client verifies the MAC to ensure message integrity and authenticity without exposing the shared secret.
2Reliability
If the shared secret is transmitted over the network for authentication, then authentication capability is improved, but vulnerability to eavesdropping increases
Solution Approach 1:
The patent uses message authentication codes (MACs) as intermediary cryptographic elements that mediate the authentication process. The server computes a MAC using the shared secret key and transmits it with the authentication message, while the client verifies the MAC to ensure message integrity and authenticity without exposing the shared secret.
Solution Approach 2:
The authentication process is segmented into distinct phases: key establishment, authentication request with MAC, and verification. The shared secret is never transmitted raw; instead, it is segmented into cryptographic operations where only derived values (MACs) are transmitted over the network, separating the sensitive key material from the communication channel.
3Ease of operation
If session identifiers are transmitted over insecure channels, then ease of use is improved, but susceptibility to session hijacking increases
Solution Approach 1:
The protocol performs preliminary actions by establishing a shared secret key between client and server before authentication. The server generates a random shared secret key and transmits it to the client through a secure key exchange mechanism, preparing the cryptographic foundation needed for subsequent authentication operations over the insecure channel.
Solution Approach 2:
The authentication protocol implements feedback mechanisms where the server sends authentication responses containing MACs that the client must verify. This feedback loop ensures that only authenticated sessions can proceed, providing continuous verification of security without complicating the user experience.
Data Source
AI summary
An apparatus and a method for an authentication protocol. In one embodiment, a server generates a sequence number, and a server message authentication code based on a server secret key. The server sends the sequence number, an account identifier, and the server message authentication code to the client. The client generates a client message authentication code over the sequence number, a request specific data, and a shared secret key between the client and the server. The client sends a request to the server. The request includes the sequence number, the account identifier, the server message authentication code, the request specific data, and the client message authentication code. The server determines the validity of the client request with the shared secret key.