Session Resumption via Salted Hashes for Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication session resumption mechanisms, such as TLS 1.3, do not adequately ensure client privacy in ad-hoc wireless settings, as they rely on static session identifiers that can be used for user tracking and may lead to unnecessary asymmetric authentication due to network interruptions.
Innovation Solution
A method where a wireless device generates a salt and sends salted hashes of the resumption identifier along with the salt to the server, allowing the server to hash and store resumption identifiers with the salt, thereby preventing tracking and reducing computational overhead during session resumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static session identifiers are used for session resumption, then session resumption efficiency is improved, but client privacy is compromised due to user tracking
Solution Approach 1:
The patent applies dynamics by transitioning from static session identifiers to dynamic salted hashes. The server generates a random salt value and combines it with the session identifier, then hashes the combination. This dynamic approach ensures that the same session identifier produces different hashed values across multiple connections, preventing tracking while maintaining resumption efficiency.
Solution Approach 2:
The patent changes the parameter representation by transforming the session identifier through a hashing function combined with a random salt. Instead of using the raw session identifier directly, the system transforms it into a salted hash, which maintains the uniqueness and verifyability of the identifier while eliminating the tracking vulnerability of static identifiers.
2Reliability
If asymmetric authentication protocols are used, then authentication security is improved, but authentication phase duration increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing symmetric session keys through asymmetric authentication during the initial connection. These pre-shared keys are then stored and reused for subsequent session resumptions. This preliminary key establishment eliminates the need for repeated asymmetric authentication, significantly reducing the authentication phase duration while maintaining security through the pre-established cryptographic keys.
3Object-affected harmful factors
If session identifiers are frequently updated, then tracking prevention is improved, but computational overhead increases
Solution Approach 1:
The patent applies partial action by implementing selective salt generation. Rather than generating new salts for every single session resumption, the system generates a new salt value periodically or under specific conditions (such as after a certain number of resumptions or after a time threshold). This partial updating approach maintains tracking prevention effectiveness while significantly reducing the computational overhead of frequent hash operations.
Data Source
Figure 1
Figure 2
AI summary
Various embodiments relate to a method and system for resuming a secure communication session with a server by a device, including: sending a message to the server requesting the resumption of a secure communication session; receiving from the server a server identifier, a server nonce, and a salt; determining that the device has a shared key with the server based upon the server identifier; determining that the received salt is valid; calculating a salted identifier based upon the shared key and the salt; sending the salted identifier to the server; and resuming the secure communication session with the server.