Server-Side Seed Management for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing communication channels between mobile handsets and remotely accessible servers are vulnerable to compromise, as both devices need to possess seed values and counter values, which can be obtained and fraudulently used if the mobile handset is compromised, and encrypted data may not be securely stored.
Innovation Solution
A method and system that involve receiving a unique device identifier and an interaction data element from a computing device, validating the interaction data element, and updating records to associate the device with a potential security threat if it is not valid, using a sequence-based approach to manage interaction data elements and generate new ones, ensuring secure communication by asymmetrically encrypting key transfer messages and using dynamic symmetric keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If seed values and counter values are stored on the mobile handset to enable single-use key generation, then secure communication can be established, but the system becomes vulnerable to compromise if the handset is compromised
Solution Approach 1:
The patent extracts the seed value and counter value from the mobile handset and relocates them to the remotely accessible server. This extraction eliminates the vulnerability where compromised handsets could expose these values, as the server-controlled values cannot be extracted from a compromised device. The server generates and manages these values, transmitting only necessary information to the handset without storing sensitive data there.
Solution Approach 2:
The patent introduces a third-party server as an intermediary that controls and manages the seed values and counter values. Instead of the handset directly generating keys using locally stored values, the server acts as an intermediary that provides these values to the handset for key generation, thereby maintaining security while enabling the communication function.
2Reliability
If interaction data elements are validated against expected values in a sequence, then security against fraudulent use is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing and storing the sequence of expected interaction data elements on the server before the actual communication occurs. The server maintains a record of what interaction data elements are expected in sequence, allowing for automated validation without complex real-time computation or decision-making during the communication process.
Data Source
AI summary
A method and system for associating a unique device identifier with a potential security threat are described. In a method conducted at a remotely accessible server, a unique device identifier is received from a computing device. The unique device identifier is associated with a record and is usable in identifying the computing device. An interaction data element is received from the computing device. The received interaction data element is validated including confirming that the received interaction data element matches an expected interaction data element associated with the record. Based on determining that the received interaction data element is not valid, the record is updated to associate the unique device identifier with a potential security threat. The interaction data element is updated periodically according to a sequence. The expected interaction data element changes based on the sequence.