Lightweight UE Authentication Using Split Secrets and Cloud Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems for wireless devices, such as RSA and Diffie-Hellman methods, consume significant power on resource-constrained UEs and are vulnerable to security attacks, particularly in IoT systems, due to the use of asymmetric cryptography and large exponent calculations.
Innovation Solution
A lightweight authentication system using quadratic residue-based encryption divides access credentials into two partial secrets, storing one on the device and one in the cloud, and employs a randomizer module to encrypt and scramble messages, ensuring secure authentication without single points of failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric cryptography methods (RSA, Diffie-Hellman) are used for authentication, then security is improved, but power consumption increases significantly
Solution Approach 1:
The patent segments the authentication credentials into two partial secrets: one stored on the resource-constrained device and another stored on the server. This segmentation eliminates the need for computationally intensive asymmetric cryptography on the device while maintaining security, as the server performs the heavy cryptographic operations and the device only needs to store and present its partial secret.
2Reliability
If large exponent calculations are performed for authentication, then cryptographic security is enhanced, but computational complexity increases
Solution Approach 1:
The patent introduces a server as an intermediary that handles all complex cryptographic operations. The resource-constrained device acts as a simple client that stores its partial secret and communicates with the server. The server performs the large exponent calculations and cryptographic verification, effectively mediating the complex computational tasks away from the constrained device.
3Ease of operation
If authentication credentials are stored in a single location, then access is simplified, but security vulnerability increases due to single point of failure
Solution Approach 1:
The patent divides authentication credentials into two separate partial secrets stored in different locations: one on the resource-constrained device and another on the server. This segmentation eliminates the single point of failure vulnerability, as compromising one location does not expose the complete authentication credential. The system maintains operational simplicity through automated key management and seamless authentication processes.
Data Source
AI summary
This disclosure relates to a lightweight authentication service, system and method that securely authenticates the identity of a secure user equipment (UE) or a device in a communication network system. The service and associated methods work by creating two partial secrets namely a first partial secret and a second partial secret. The first partial secret is generated by the manufacturer or the owner of the UE, which is stored on a secure location on the UE and the second partial secret is stored in a database storage system on a server in a cloud running an authentication service. The encryption of information elements is done by multiplying the information elements with the square of random numbers, the encrypted secrets are randomized and before transmission on the channel. The disclosure also describes a receiver UE that could either request an authentication service, running in a cloud, to authenticate a sender UE. In another example, the receiver UE includes a receiver authentication service module that enables the receiver UE to authenticate a sender UE in a peer to peer manner and a credential core in the cloud is only used as a storage medium to provide a transformed partial secret of a sender UE.