Session Key Generation for Secure Mutual Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure mutual authentication methods between communication partners, such as reader and contact-free data cards, are susceptible to side-channel attacks and require expensive hardware measures for protection.
Innovation Solution
A protocol-based method generates a session key using a concatenation of random numbers and secret information, providing secure authentication and data transfer without expensive hardware protection measures, utilizing a non-linear concatenation and AES encryption to protect against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware measures for protecting encryption are used, then security against side-channel attacks is improved, but cost increases
Solution Approach 1:
The patent uses disposable session keys that are generated for each authentication session and then discarded. This approach replaces expensive hardware protection measures with cheap software-based ephemeral keys, achieving security without high manufacturing costs. The session keys are derived from random numbers and secret information, used once for authentication, and then discarded to prevent side-channel attacks.
Solution Approach 2:
The patent changes the parameter of key longevity from permanent (hardware keys) to ephemeral (session keys). By using temporary session keys that change with each session rather than static hardware keys, the system achieves protection against side-channel attacks without requiring expensive hardware measures. The keys are derived using concatenation of random numbers and secret information.
2Reliability
If challenge-response authentication method is used, then mutual authentication is achieved, but susceptibility to side-channel attacks increases
Solution Approach 1:
The patent performs preliminary generation of random numbers and session keys before the actual authentication exchange. The session key is derived in advance from the random number and secret information, so that during the challenge-response authentication, only the derived session key is used rather than the original secret key. This preliminary key derivation action protects against side-channel attacks while maintaining authentication security.
Solution Approach 2:
The patent introduces a session key as an intermediary between the secret key and the authentication protocol. Instead of using the secret key directly in challenge-response authentication, the session key serves as a mediator that is derived from the secret key and random numbers. This intermediary layer prevents direct exposure of the secret key to side-channel attacks during authentication.
Data Source
AI summary
A key-generating apparatus is provided for generating a session key which is known to a first communication apparatus and a second communication apparatus, for the first communication apparatus, from secret information which may be determined by the first and second communication apparatuses. The key-generating apparatus includes a first module operable to calculate the session key using a concatenation of at least a part of a random number and a part of the secret information, and a second module operable to use the session key for communication with the second communication apparatus.