Authentication Ticket Session Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mechanisms for secure communication between a client and an online service provider are ineffective in preventing hostile parties from accessing sensitive information, as authentication tickets can be intercepted and used for unauthorized access.
Innovation Solution
The implementation of asymmetric cryptography to generate and embed an encrypted session key within an authentication ticket, where the private key is known only to the online service provider and the public key is known to the authentication server, ensuring secure communication by encrypting information exchanged between the client and the online service provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication tickets are used to verify user identity, then access control is improved, but security deteriorates because intercepted tickets can be used for unauthorized access
Solution Approach 1:
The patent applies preliminary action by embedding an encrypted session key within the authentication ticket before the ticket is transmitted to the service provider. This pre-encryption ensures that even if the ticket is intercepted, the session key remains protected, preventing unauthorized access. The encryption is performed in advance during the authentication phase, so the protective measure is already in place before any potential interception occurs.
Solution Approach 2:
The patent uses an intermediary approach by introducing an encrypted session key as a mediator between the authentication mechanism and the service communication. This encrypted key acts as a protective layer that the service provider must decrypt to establish secure communication. The intermediary element (encrypted session key) bridges the authentication verification and the secure data transmission, adding a security buffer against ticket interception.
2Reliability
If encryption is applied to protect communications, then security is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The patent extracts the complex key management burden from the service provider by embedding the encrypted session key directly within the authentication ticket. The service provider only needs to decrypt the session key using its private key rather than managing multiple cryptographic keys separately. This extraction of the encryption mechanism into the ticket structure simplifies the service provider's implementation while maintaining strong security.
Solution Approach 2:
The patent merges the authentication verification and encryption key delivery into a single authentication ticket structure. Instead of separate mechanisms for authentication and key exchange, the solution combines these functions by embedding the encrypted session key within the same ticket that verifies user identity. This merging reduces the number of separate cryptographic operations and simplifies the overall system architecture.
Data Source
AI summary
Computer-readable media, systems, and methods for encrypting communications between a client and an online service provider to ensure the communications are secure. In embodiments an authentication request is received from a user agent associated with the client and the authentication request includes identification information and authentication information. Additionally, it is determined that the identification and authentication information are associated with a user. An authentication ticket is created that includes a user identification and an authentication and indicates to the online service provider that the user is authenticated to access one or more services. Further, a session key is generated and an encrypted session key is embedded into the authentication ticket. The session key is encrypted and the private key is known only to the online service provider and the public key is known at least by an authentication server.