A DID-based one-time session key authentication mechanism for secure human-AI chatbot communication

Abstract

As generative Artificial Intelligence (AI) technology has recently gained popularity, society is undergoing a full-scale transformation centered around AI. This technology is attracting attention across various fields, particularly as it meets the growing demand for ‘24/7 availability’. Among these applications, AI chatbot-based Robotic Process Automation (RPA) systems have demonstrated the ability to automate tasks, and with the integration of generative AI, they can now handle more advanced operations such as sending emails and managing complex workflows. However, because AI chatbot-based RPA systems are required to perform sensitive and high-level tasks, secure identity authentication is essential. Traditional Public Key Infrastructure (PKI)-based authentication mechanisms pose risks, as they often require storing personal information within the AI chatbot system—potentially increasing the damage in the event of a security breach. To address this issue, this paper proposes an authentication mechanism that uses a Decentralized Identity (DID)-based one-time session key. By leveraging DID technology, the proposed mechanism ensures self-sovereignty and privacy. Furthermore, the use of a one-time session key guarantees session independence, non-reusability, and untraceability. A performance comparison with PKI-based mechanisms shows that when more than five authentications are performed, the proposed mechanism achieves higher time efficiency, highlighting its advantages in both security and effectiveness. Additionally, potential security threats in each step of the proposed system are analyzed probabilistically. A mathematical formula is presented to demonstrate that the likelihood of such threats occurring is very low. By performing partial differentiation on the attack success probability with respect to representative variables at each step, the analysis identifies which authentication process most significantly influences overall system security. This provides clear insights for designing secure authentication systems based on the proposed approach.