SoC Secure Authentication via Dynamic Password Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password-based authentication mechanisms are vulnerable to unauthorized access since passwords are often reused across devices, making it impossible for systems like set-top boxes to distinguish between legitimate and unauthorized users, and they lack secure communication protection during transmission.
Innovation Solution
A System-on-Chip (SoC) with a unique password generation mechanism using a random number generator, chip ID, and a secret word, combined with a hash function, ensures that each authentication process produces a distinct password, unique per operation and per device, enhancing security by comparing generated and received passwords within the SoC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional password-based authentication is used, then authentication simplicity is maintained, but security is compromised due to password reuse across devices
Solution Approach 1:
The authentication system is segmented into multiple components: a challenge generation module in the STB, a response generation module in the external device, and a verification module. Each component performs a specific function, allowing the system to achieve strong security through distributed computation rather than relying on a single complex password storage mechanism.
Solution Approach 2:
The system performs preliminary actions by pre-storing secret values and hash functions in the external device, and pre-configuring challenge generation logic in the STB. During authentication, these pre-configured elements are combined with dynamic challenges to generate unique passwords, eliminating the need to store actual passwords while maintaining security.
2Reliability
If unique passwords per device are implemented, then unauthorized access is prevented, but authentication process complexity increases
Solution Approach 1:
A hash function acts as an intermediary between the stored secret values and the generated password. The hash function transforms static secret data into dynamic passwords that are unique to each device and authentication attempt, without requiring the system to store or transmit actual passwords. This intermediary layer provides security while keeping the authentication flow relatively simple.
Solution Approach 2:
The authentication system transitions from static password storage to dynamic password generation. Passwords are generated on-the-fly by combining device-specific secret values with challenge inputs, ensuring that each authentication attempt produces a unique password even for the same device. This dynamic approach prevents password reuse attacks while maintaining manageable complexity.
3Ease of operation
If passwords are transmitted for verification, then authentication can be performed, but communication security is compromised during transmission
Solution Approach 1:
The actual secret values and password generation logic are extracted from the transmission path. Instead of transmitting passwords or secret keys, the system transmits only challenges from the STB and verified authentication results. The sensitive secret values remain securely stored in the external device and never leave the device, eliminating the transmission security vulnerability while maintaining verification capability.
Solution Approach 2:
The system replaces the mechanical approach of transmitting passwords with a cryptographic computation approach. Rather than sending authentication credentials over the network, both parties perform local computations using their respective secret values and shared challenges, then compare results. This substitution eliminates the need for secure password transmission while achieving the same authentication goal.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A SoC may be utilized to authenticate access to one or more secure functions. A password may be generated within the SoC which is unique to each SoC instance and unique to each iteration of authentication. The SoC may challenge external entities attempting access to provide a matching password. A random number sample may be generated within the SoC and stored. A chip ID, secret word and a table of keys with key indices are also stored in memory. Two or more of the stored items may be passed to a hash function to generate the password. The external entity may generate and return the password utilizing information communicated from the SoC during each authentication operation as well as information known a priori. The SoC may compare the returned password with the internally generated password and may grant access to the secure functions.