Third-Party Authentication for Secure Wireless Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing secure communications between untrusted devices over insecure networks is challenging, especially for devices with limited processing resources and non-technical users, as it requires complex encryption and authentication processes, which can be cumbersome for small wireless networks like Wi-Fi WLANs.
Innovation Solution
The method involves using removable modules like SIM cards with embedded secret keys and algorithms to securely forward and derive common shared keys, with an authentication server managing the process, eliminating the need for users to manually enter secret keys by relying on a trusted third party for authentication and key provision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is implemented using large random keys and public key cryptography systems to provide strong security, then security level is improved, but processing resource consumption increases and technical complexity increases
Solution Approach 1:
The patent introduces a SIM card as an intermediary security module that contains embedded cryptographic keys and authentication logic. This mediator handles the complex encryption and authentication operations, shielding end-users from technical complexity while maintaining strong security. The SIM card acts as a trusted third party that enables secure communication without requiring users to directly manage cryptographic keys or understand encryption protocols.
2Ease of operation
If SIM cards are used for centralized network operator authentication, then ease of operation is improved, but device compatibility and applicability to other network types deteriorates
Solution Approach 1:
The patent extends the SIM card's functionality beyond traditional cellular networks to enable authentication and secure key distribution in ad-hoc wireless networks and other non-cellular network types. The SIM card serves multiple purposes: it acts as both a traditional subscriber identity module for cellular networks and a portable authentication credential for various other network configurations, making the solution universally applicable across different network architectures.
3Reliability
If manual entry of secret shared keys is required for WLAN authentication, then security control is improved, but ease of operation and setup time deteriorates
Solution Approach 1:
The system enables automatic authentication where the SIM card autonomously provides security credentials and performs authentication operations without requiring manual user input. The user simply needs to insert the SIM card, and the system automatically handles key generation, encryption parameter configuration, and authentication protocol execution, eliminating the need for manual entry of secret keys while maintaining security control.
4Reliability
If encryption and authentication parameters are manually configured for each device, then security customization is improved, but productivity and setup time deteriorates
Solution Approach 1:
The SIM card is pre-configured with cryptographic keys, authentication algorithms, and security parameters before deployment. This preliminary preparation eliminates the need for time-consuming on-site configuration during network setup. When a user inserts the SIM card into a device, the pre-configured security parameters are automatically activated, enabling rapid deployment while maintaining customized security settings tailored to the specific network requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to communications, and in particular though not exclusively to forming a secure connection between two untrusted devices. The present invention provides a method of securely connecting a first device (A) to a second device (B) using a third party authentication server (AS) coupled to the second device, the first device and the authentication server both having first device shared secret data (SSDa) and the second device and the authentication server both having second device shared secret data (SSDb). The method comprises receiving a request from the first device at the authentication server; the authentication server and the first device both generating a first device key (K_A) using the first device shared secret data in response to a first device random number (RANDa) sent from the authentication server to the first device; the authentication server and the second device both generating a second device key (K_B) using the second device shared secret data in response to a second device random number (RANDb) sent from the authentication server to the second device; and the authentication server securely forwarding to the second device (B) and the first device (A) a common key (K_AB) using the second and first device keys (K_B, K_A).