Username-Based Key Exchange for Secure Channel Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure communication protocols face challenges in sharing a shared secret over unsecured channels without exposing it to eavesdroppers, as existing methods require clear text transmission, which can lead to interception and decryption.
Innovation Solution
A method and system that generate a shared master secret using a username-based key exchange, where a client and server compute a salt value, message authentication code, and random strings to establish a secured communication channel over an unsecured network, utilizing these values to create a media authentication code for encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a shared secret is transmitted in clear text to establish secure communication, then the communication channel can be established quickly, but the secret can be intercepted by eavesdroppers
Solution Approach 1:
The patent introduces an intermediary authentication process where the shared secret is never transmitted directly. Instead, it is computed locally by both parties using a username-based key exchange mechanism. The server generates a secret based on the username and communicates only authenticated data (not the secret itself), acting as an intermediary that enables secret establishment without direct transmission.
Solution Approach 2:
The patent performs preliminary authentication and secret generation before any actual communication occurs. The username-based key exchange establishes the shared secret in advance through an authentication challenge-response mechanism, ensuring the secret is already in place and never needs to be transmitted during subsequent communications.
2Ease of operation
If a password is transmitted in clear text for authentication, then the authentication process is simple, but the password can be stolen by eavesdroppers
Solution Approach 1:
The patent uses the username as an intermediary to derive the authentication credential. Instead of transmitting or comparing clear text passwords, the system computes a secret from the username on both client and server sides. This intermediary mechanism (username-based derivation) maintains authentication functionality while eliminating clear text password transmission.
Solution Approach 2:
The patent replaces the mechanical password transmission and comparison system with a computational key exchange system. Instead of sending passwords and comparing them, the system uses cryptographic functions to derive shared secrets from usernames, substituting a secure computational mechanism for the vulnerable mechanical transmission process.
3Reliability
If a salt value is added to passwords to prevent brute force attacks, then password security is improved, but the password must still be transmitted in clear text for hashing
Solution Approach 1:
The patent eliminates the need for clear text password transmission by using the username as an intermediary. The username-based key exchange derives the authentication credential computationally, removing the requirement to transmit passwords even in clear text form for hashing operations. The salt concept is replaced by the username itself serving as the basis for secret derivation.
Data Source
AI summary
A method and apparatus for an system and process for sharing a secret over an unsecured channel in conjunction with an authentication system. A client computes a message authentication code based on a hashed password value and a first random string received from the server. The client sends a response to the server that includes authentication data including a second random string. Both the client and server concatenate the first random string, second random string and username. Theses values are processed to generate as a shared master secret to further generate shared secrets or keys to establish a secured communication channel between the client and server. The secured communication can be based on stateless messaging where the decryption key associated with the message is identified by the message authentication code, which is placed within the message.