Advanced Security Negotiation Protocol for SPNEGO Renegotiation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Simple and Protected Negotiation Mechanism (SPNEGO) lacks the ability to renegotiate after a failed initial roundtrip and does not support the use of auxiliary data, which is essential for determining authentication between clients and servers based on trust anchors.
Innovation Solution
An advanced security negotiation protocol is introduced that allows renegotiation and includes auxiliary data, using a Windows Security Type (WST) Library message with a fixed length header and variable length payload to reduce redundant roundtrips and implement key exchanges through a Security Support Provider (SSP), maintaining backward compatibility and minimizing context establishment tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If SPNEGO negotiates a common mechanism during the first round of negotiation, then the negotiation process is simplified, but the client cannot attempt a different security package if the negotiated mechanism fails
Solution Approach 1:
The patent implements dynamic renegotiation capability that allows the negotiation process to adapt and change security packages after initial failure. The system transitions from a static single-round negotiation to a dynamic multi-round process where the client can request renegotiation with alternative security packages, making the negotiation process flexible and adaptive to authentication failures.
Solution Approach 2:
The patent establishes preliminary negotiation parameters and security package lists before actual authentication attempts. By pre-defining multiple security packages and negotiation parameters in advance, the system prepares multiple fallback options that can be activated through renegotiation when the initial authentication fails, enabling versatile security package selection without increasing runtime complexity.
2Device complexity
If SPNEGO does not provide support for auxiliary data, then the negotiation mechanism remains simple, but configuration information such as trust anchors cannot be properly exchanged
Solution Approach 1:
The patent introduces auxiliary data as an intermediary carrier that transports essential configuration information (such as trust anchors, security policies, and authentication parameters) between client and server during the negotiation process. This auxiliary data structure acts as a mediator that enables reliable authentication by facilitating the exchange of critical configuration information without complicating the core negotiation mechanism.
Solution Approach 2:
The patent adds a new dimension to the negotiation protocol by incorporating auxiliary data fields that operate parallel to the main negotiation flow. This dimensional extension allows configuration information to be exchanged alongside security package negotiations without interfering with the existing simple negotiation mechanism, thereby maintaining protocol simplicity while enabling reliable authentication through trust anchor exchange.
3Ease of operation
If multiple authentication messages are sent in separate roundtrips, then each message can be processed individually, but redundant roundtrips increase operational costs and reduce efficiency
Solution Approach 1:
The patent merges multiple authentication messages into a single consolidated negotiation message that can be transmitted in one roundtrip. By combining multiple authentication attempts, security package selections, and auxiliary data exchanges into a unified message structure, the system reduces the number of roundtrips required while maintaining the ability to process individual authentication elements separately on the receiving end, thereby improving authentication efficiency without sacrificing processing simplicity.
Data Source
AI summary
This disclosure describes methods, systems and application programming interfaces for creating an advanced security negotiation package. This disclosure describes creating an advanced security negotiation protocol under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol to negotiate an authentication scheme. The protocol describes defining a Windows Security Type (WST) Library message to protect negotiation data during the advanced security negotiation protocol. The protocol sends an initial message that carries multiple authentication messages to reduce redundant roundtrips and implements key exchanges by a mini Security Support Provider (SSP).