Network Authentication Using Split Private Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network authentication methods for secure electronic transactions are inadequate due to vulnerabilities in customer identity and personal information protection, particularly in insecure customer computer environments, where malicious software can steal user IDs and passwords, and the use of additional verification devices is inconvenient and costly.
Innovation Solution
A network authentication method using a client device and a verification server, where an asymmetric key pair is generated and divided into portions, with the client device encrypting a private key portion using a PIN code to create a digital signature for transaction data, ensuring secure authentication without the need for additional verification devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional one-factor authentication using user-id and password is used, then the authentication process is simple, but the security against malicious software attacks is insufficient
Solution Approach 1:
The private key is divided into multiple portions (first private key portion stored in client device, second private key portion stored in authentication server). This segmentation ensures that no single point of failure exists and malicious software cannot obtain the complete private key needed for authentication.
Solution Approach 2:
An authentication server acts as an intermediary between the client device and the verification server. The authentication server holds the second private key portion and coordinates the authentication process, adding a layer of security against direct attacks on the client device or verification server.
2Reliability
If identity verification devices such as USB devices with PKI certificates are added, then the security is improved, but the device complexity and cost increase
Solution Approach 1:
The authentication system uses a universal authentication server that can serve multiple institutions and clients. The server-based architecture eliminates the need for each institution to distribute and manage separate physical verification devices, providing a multi-functional solution that reduces overall system complexity.
Solution Approach 2:
Instead of requiring physical verification devices like USB tokens or smart cards, the system uses digital copies of key portions stored in software form on the client device and authentication server. This virtualization eliminates the need for physical hardware while maintaining security.
3Reliability
If different identity verification devices are required for different institutions, then the security is enhanced, but the convenience for customers deteriorates
Solution Approach 1:
The authentication server is designed as a universal system that can authenticate users across multiple institutions. The server stores institution-specific information and coordinates authentication requests from different institutions, allowing customers to use the same client device for multiple institutions without needing separate verification devices.
Data Source
AI summary
In a network authentication method, a client device stores a reference first private key portion obtained by encrypting a first private key portion of a private key. The private key and a public key cooperatively constitute an a symmetric key pair. After receipt of a second private key portion of the private key, the client device generates a digital signature for transaction data using a current key which combines the second private key portion and a current key portion obtained by decrypting the reference first private key portion. A verification server verifies, based on the public key, whether a received digital signature is signed with the private key, and obtains the transaction data when verification result is affirmative.