Terminal Authentication via Certificate Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for user terminals in network connections only verify the integrity of data transmission and the identity of the server, but fail to ensure that the request is made by the legitimate user from the correct device, leaving room for misuse by third parties.
Innovation Solution
Implementing a public-key authentication method using metadata and unique identifiers from the connection network to create and verify certificates, ensuring that each request is validated as coming from a legitimate and authorized terminal device, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS encryption and digital signatures are used to protect data transmission and verify server identity, then data transmission security is improved, but the ability to verify the user's terminal device identity deteriorates (no verification of which device the request comes from)
Solution Approach 1:
The authentication process is segmented into two independent parts: server authentication (handled by existing TLS) and terminal device authentication (handled by the new certificate mechanism). This allows each authentication aspect to be verified separately, resolving the contradiction between maintaining transmission security and enabling terminal identification.
Solution Approach 2:
A certificate creation unit acts as an intermediary between the routing unit and the target system. This intermediary generates certificates that bind terminal device identifiers to authentication credentials, enabling the target system to verify terminal identity without compromising the existing TLS encryption framework.
2Reliability
If username and password authentication is used to verify user identity, then user legitimacy is improved, but the verification of the actual terminal device deteriorates (cannot determine which device the request is made from)
Solution Approach 1:
The patent merges user identity verification and terminal device verification into a single certificate-based authentication mechanism. The certificate contains both user identification information and terminal device identification, allowing simultaneous verification of both aspects in one authentication step rather than requiring separate username/password and device verification processes.
Solution Approach 2:
The authentication parameters are changed from traditional username/password strings to cryptographic certificates containing structured identification data. This parameter change enables precise terminal device identification while maintaining user identity verification, as the certificate embeds both user and device identifiers in a machine-verifiable format.
3Device complexity
If no additional authentication beyond TLS is implemented, then system complexity is reduced, but security against third-party misuse deteriorates (anyone with network access can impersonate the user)
Solution Approach 1:
The certificate creation unit performs preliminary authentication actions by generating and issuing certificates to authorized terminal devices before they access the target system. This preliminary binding of device identity to authentication credentials prevents third-party misuse without requiring complex runtime verification mechanisms, as the authentication capability is pre-configured in the certificate itself.
Data Source
Figure 1
AI summary
The present invention relates to a method for authenticating a user's terminal device (101, 201) when using a service provided by a target system (601) via a connection network (300, 400, 500), wherein a certification service (501) provides metadata extracted from a user request together with a unique identifier (102, 204) for the terminal device (101, 201) to a certificate creation unit (700), which creates a certificate for the unique identifier (102, 204) using the provided metadata, which is used to sign the request, and the target system (601) authenticates the terminal device (101, 201) sending the request by means of the signature. Furthermore, the invention relates to a corresponding system for authenticating a terminal device (101, 201) of a user when using a service provided by a target system (601) via a connection network (300, 400, 500).