Server-Side Private Key Management for Mobile Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure communication protocols, such as SSL, are insufficient for securing authentication credentials and device fingerprints between mobile client applications and backend servers, as they expose private keys to compromise during storage and transmission.
Innovation Solution
Implementing a system where a server processor generates and stores a public/private key pair without sending the private key to the user's device, using the public key to encrypt and decrypt session keys for secure communication, ensuring that sensitive information remains protected without local storage of private keys on the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private keys are stored on the client device for authentication, then authentication functionality is enabled, but security is compromised due to vulnerability of private key exposure
Solution Approach 1:
The patent extracts the private key from the client device environment entirely. Instead of storing or transmitting private keys to the client, the system uses only public keys on the client side and keeps private keys exclusively on the server side, eliminating the security vulnerability of private key exposure while maintaining authentication functionality
Solution Approach 2:
The patent introduces session keys as an intermediary mechanism. Rather than directly using private keys for communication, the system employs session keys that are encrypted with public keys for transmission and decrypted by the server using its private key, thereby mediating the authentication process without exposing private keys
2Reliability
If SSL protocol is used for securing communication, then basic encryption is provided, but authentication credentials remain vulnerable to compromise
Solution Approach 1:
The patent fundamentally changes the cryptographic parameter distribution model. Instead of the traditional SSL model where private keys are distributed to clients, the system modifies the key management parameters so that private keys remain exclusively on the server side, while public keys and session keys are used on the client side, thereby eliminating the vulnerability of authentication credential exposure
3Reliability
If public/private key pairs are distributed to client devices for encryption, then payload encryption capability is enabled, but private key storage vulnerability is introduced
Solution Approach 1:
The patent extracts the private key management responsibility entirely from the client device. The client device only stores and uses public keys (which are safe to distribute) and temporary session keys, while the server retains exclusive control of private keys, thereby enabling payload encryption without introducing private key storage vulnerability or complex key management on the client side
Data Source
AI summary
Methods and systems for secure electronic communication involve, for example, using a processor coupled to memory to receive a request message from a user's communication device processor including a session key encrypted with a public key of a public/private key pair without sending a private key of the public/private key pair to, or storing the private key on, the user's communication device. Using the processor, the request message is decrypted with a private key of the public/private key pair and the session key is retrieved from the decrypted request message. Thereafter, also using the processor, a response message is generated and encrypted with the retrieved session key and sent to the user's communication device processor.