Asymmetric Key Fragmentation for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional user authentication methods, such as username-password pairs, are insecure and inconvenient, especially for large organizations with high turnover rates, as they require complex passwords that are hard to remember and often lead to security weaknesses due to password reuse and rotation.
Innovation Solution
The implementation of a secure remote user authentication system using public key cryptography and key splitting, which eliminates the need for users to remember complex passwords by splitting private keys into fragments stored on both the user's device and a server-side identity service, allowing authentication without revealing the entire private key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username-password authentication is used, then user authentication is simple to implement, but security is compromised due to password storage risks and user convenience issues
Solution Approach 1:
The patent segments the authentication process into two distinct phases: registration phase where the server generates and stores only the public key, and login phase where the client proves ownership of the private key through cryptographic challenge-response. This segmentation eliminates password storage while maintaining security and convenience.
Solution Approach 2:
The patent introduces public key cryptography as an intermediary mechanism between the client and server. Instead of directly sharing secrets (passwords), the system uses asymmetric key pairs where the public key serves as a safe intermediary that enables authentication without exposing sensitive private information.
2Reliability
If complex passwords are required for security, then authentication security improves, but user memory burden increases and password reuse becomes more likely
Solution Approach 1:
The patent replaces the mechanical system of human memory and password management with cryptographic mechanisms. Instead of relying on users to remember complex passwords, the system uses automated cryptographic challenge-response protocols that provide equivalent or superior security without cognitive burden.
3Ease of operation
If passwords are stored on the server for authentication, then user login is straightforward, but the server becomes vulnerable to hacker compromises
Solution Approach 1:
The patent extracts the vulnerable element (password storage) from the authentication system. By removing password storage from the server entirely and replacing it with public key infrastructure, the system maintains login simplicity while eliminating the security vulnerability of stored credentials.
Solution Approach 2:
The patent converts the potential harm of key management into benefit by using asymmetric cryptography. The public key, which must be stored on the server for authentication to work, is inherently secure for storage purposes since it cannot be used to derive the private key. This transforms what could be a security risk into a security advantage.
Data Source
AI summary
A method is disclosed. The method includes, in a client device, acquiring first and second asymmetric cryptographic key pairs for a user, where each key pair includes a public key and a corresponding private key, securing the private key of the second key pair in a cryptographic processor, and splitting the private key of the first key pair into plural private key fragments, so that a sum of the plural private key fragments equals the private key of the first key pair. The method further includes storing at least one of the plural private key fragments on the client device, and registering the user with an identity service not hosted on the client device. Registering the user includes providing to the identity service, for use in securely authenticating the user, the public keys of the first and second key pairs, and the plural private key fragment(s) excluding the at least one private key fragment secured on the client device.