Telecommunication Security via Transaction ID Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Telecommunications networks face challenges in securing communications due to weaknesses in protocols like SMTP, increased computational power for bulk message sending, and the complexity of verifying message authenticity, leading to issues such as spam and phishing attacks.
Innovation Solution
A method involving an Authorization Server that generates a session key based on a secret key shared with entities A and B, using a one-way function of the secret key and a transaction number, and transmitting a transaction ID to entity B for verification, allowing entity B to calculate the session key and protect against flooding attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (like Kerberos) are used to verify entity identity, then security against impersonation is improved, but the system becomes vulnerable to flooding attacks and computational burden increases
Solution Approach 1:
Entity B pre-calculates a set of expected transaction identifier values (IDTR_N) corresponding to a sequence of transaction numbers before the actual transaction occurs. This preliminary preparation allows B to quickly verify received identifiers without real-time computation, preventing flooding attacks while maintaining authentication reliability.
Solution Approach 2:
The patent uses disposable, short-lived transaction identifiers (IDTR_N) that are valid for only one transaction. Each identifier is cheap to generate and verify, replacing complex cryptographic verification with simple lookup operations. The identifiers expire after use, preventing replay attacks without requiring long-lived security credentials.
2Reliability
If digital signatures are added by the calling domain to guarantee message origin, then message authenticity is improved, but the complexity of verification and device overhead increases
Solution Approach 1:
The patent extracts the authentication function from complex digital signature verification and separates it into two parts: the Authorization Server generates cryptographic proofs, while entity B only needs to perform simple verification of transaction identifiers. This extraction reduces verification complexity at the receiving end while maintaining authenticity guarantees.
Solution Approach 2:
The Authorization Server acts as an intermediary that generates and manages cryptographic credentials (transaction identifiers). Instead of entities directly performing complex signature verification, the intermediary pre-processes authentication data into simple, verifiable identifiers that B can check against pre-calculated values.
3Ease of operation
If session keys are transmitted directly from Authorization Server to both entities, then key distribution is simplified, but security against interception is reduced
Solution Approach 1:
The patent extracts the session key from the transaction identifier. Instead of transmitting the actual session key through the network, the system transmits only the transaction identifier (IDTR_N) which can be used by both parties to independently derive the session key. This extraction eliminates key transmission vulnerabilities while maintaining distribution simplicity.
Solution Approach 2:
Both entity A and entity B receive the same transaction identifier (IDTR_N) from the Authorization Server. Each party independently copies/derives the session key from this shared identifier using the same cryptographic function and their respective secrets. This copying approach ensures both parties have identical keys without requiring direct key transmission between them.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method allowing secure communication in a telecommunications network, in which a transaction between an entity A and an entity B of the network comprises the following steps, namely: entity A sends an authorisation request to an authorisation server S, in which entity A is identified and authenticated; entity A informs the authorisation server S of the intention thereof to communicate with entity B; the authorisation server S determines a secret key K SB that it shares with entity B; the authorisation server S creates a session key K AB,N which it sends to entity A, said session key K AB,N being a one-way function of the secret key K SB and also being a function of an integer N, known as the transaction number, assigned to said transaction; the authorisation server S also creates a transaction identifier which is a function dependent on at least said transaction number N in a non-reversible manner; the authorisation server S provides entity B with elements comprising at least the transaction identifier; entity B checks at least that the value of the received transaction identifier appears in a set of values pre-calculated by entity B and corresponding to at least one predicted value for the transaction number; and, if this is the case, entity B first deduces therefrom the current value of the transaction number N and subsequently the value of the session key K AB,N.