Third-Party Signature Authentication for Secure Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication protocols, such as IKE, face challenges with lengthy certificates and certificate chains, which can cause fragmentation issues and require significant memory and processing resources, especially when entities do not support fragmentation or certificate handling.
Innovation Solution
The use of a third party for authentication, where the initiator verifies the responder's signature based on the third party's signature, eliminating the need for lengthy certificate chains and allowing for authentication over a secure communication channel without requiring fragmentation support.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public-key-signature-based authentication with certificates is used, then authentication security is improved, but certificate size and processing complexity increase
Solution Approach 1:
The patent extracts the authentication function from the certificate chain verification process. Instead of requiring full certificate chains, the system uses a third party to sign authentication data, separating the authentication mechanism from the certificate infrastructure and eliminating the need for complex certificate chain processing while maintaining security
Solution Approach 2:
The patent introduces a third party as an intermediary that signs authentication data bound to the secure communication channel. This intermediary approach allows the initiator to verify authentication without needing to process the responder's certificate chain, as the third party's signature serves as sufficient proof of authenticity
2Reliability
If lengthy certificates and certificate chains are used, then authentication reliability is improved, but memory and processing requirements increase
Solution Approach 1:
The patent extracts only the essential authentication element (the third party's signature on authentication data) from the complete certificate chain structure. This extraction reduces the data volume from kilobyte-sized certificates to compact signed authentication data, dramatically reducing memory and processing requirements while preserving authentication reliability
Solution Approach 2:
The system uses a copy of the third party's public key (which is small and can be pre-configured) instead of the full responder certificate chain. The initiator verifies authentication by checking the signature against the third party's public key, avoiding the need to store and process large certificate data
3Reliability
If traditional certificate-based authentication is used, then authentication security is maintained, but fragmentation issues occur
Solution Approach 1:
The patent extracts the authentication verification from the certificate transmission process. By using a third party's signature on authentication data rather than transmitting full certificates, the system eliminates fragmentation issues that occur when large certificate data is transmitted over networks that don't support fragmentation
Solution Approach 2:
The system uses lightweight authentication data with third party signatures instead of heavy certificate structures. These compact authentication elements can be transmitted efficiently without requiring fragmentation support, making the system compatible with networks and devices that have limited fragmentation capabilities
Data Source
AI summary
Secure, authenticated communication is enabled between an initiator (12) (e.g., a user equipment) and a responder (14) (e.g., an authentication server function, AUSF, or a subscription de-concealing function, SIDF). The initiator (12) transmits a message (20) to the responder (14) over a secure communication channel (16). The message (20) may include information indicating a third party (18) whose signing of data (e.g., bound to the secure communication channel (16)) will authenticate the responder (14) to the initiator (12). The responder (14) correspondingly retrieves from the third party (18) data that is signed by the third party (18) and transmits a response (24) to the initiator (12) that includes the retrieved data. The initiator (12) receives this response (24) and determines whether or not the responder (14) is authenticated by determining whether or not the response (24) includes data that is signed by the third party (18).