Zero-Trust Access Control Using Challenge-Response Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Zero-trust security systems face vulnerabilities in identity information security, as attackers can access resources using stolen user identifiers from compromised terminal devices, lacking effective measures to prevent identity theft.
Innovation Solution
Implement an access control method that intercepts service requests, verifies user identity through a certification server using random challenge information signed with a private key, ensuring the private key remains unreadable, and only allows access upon successful signature verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user identifiers are stored in terminal devices for authentication, then access control functionality is enabled, but security is compromised when terminal devices are compromised and identifiers are leaked
Solution Approach 1:
The patent extracts the private key from the terminal device's storage and keeps it in an unreadable state, using only the certification server to perform signature verification. This removes the vulnerable stored identifier while maintaining authentication functionality through challenge-response signature verification.
Solution Approach 2:
The patent performs preliminary identity validation by verifying signatures on challenge information before granting access to services. This preliminary verification ensures that even if terminal devices are compromised, stolen identifiers cannot be used without the corresponding private key for signature generation.
2Productivity
If traditional identifier verification is used, then access control is simple and fast, but the system is vulnerable to identity theft and cloning attacks
Solution Approach 1:
The patent implements dynamic challenge information that changes with each authentication request. The challenge information includes time stamps and random elements, making each authentication unique and preventing replay attacks or identity cloning, while maintaining efficient signature verification processing.
Solution Approach 2:
The patent introduces a certification server as an intermediary that performs signature verification. This intermediary validates the authenticity of identifiers without requiring terminal devices to store vulnerable private keys, balancing security enhancement with authentication efficiency.
3Reliability
If private keys are made unreadable for security, then identity security is improved, but the system complexity increases
Solution Approach 1:
The patent uses the certification server as an intermediary that handles the complexity of private key management and signature verification. The terminal device itself remains relatively simple, while the server absorbs the cryptographic complexity, making the overall system secure without excessively complicating client devices.
Solution Approach 2:
The patent replaces traditional mechanical storage of private keys with a cryptographic substitution approach where the private key remains unreadable and is used only for signature generation. This substitution eliminates the need for secure physical storage while maintaining security through mathematical cryptography.
Data Source
AI summary
In an access control method, a service access request of a service application is received. The service access request includes identity information of a user. An identity validation request is sent to a server. The identity validation request includes the identity information of the user. Challenge information is received from the server based on the identity information of the user in the identity validation request being determined to be valid. Signature information of the challenge information is generated based on the challenge information and a private key. The signature information is sent to the server. A signature valid message is received from the server based on the challenge information being obtained from the signature information with a public key associated with the identity information of the user. Based on the signature valid message, the service access request is sent to the server.