Augmented Single-Factor Split Key Asymmetric Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods, particularly single-factor password authentication, are vulnerable to eavesdropping and dictionary attacks, and existing split asymmetric key systems are costly and prone to phishing attacks, lacking effective protection against impostor websites and Man-In-The-Middle attacks.
Innovation Solution
The implementation of an augmented single-factor split key asymmetric cryptography system, where the private key is split into multiple portions, with one portion generated using a user's password and another portion stored securely on a server, using a rolling asymmetric crypto-key to enhance security, and an augmenting factor is stored in a cookie to strengthen authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single-factor password authentication is used, then ease of operation is improved, but security is worsened due to vulnerability to eavesdropping and dictionary attacks
Solution Approach 1:
The private key is segmented into multiple portions distributed across different locations (user device and server), so that no single point contains the complete authentication credential. This segmentation prevents dictionary attacks on stored passwords and eavesdropping from compromising the entire system.
Solution Approach 2:
The system uses asymmetric cryptography where the public key and private key portions have different roles and properties. The public key can be freely distributed while the private key portions remain secret, creating an asymmetric security model that protects against eavesdropping while maintaining ease of operation.
2Reliability
If split asymmetric key systems are implemented, then security is improved, but device complexity and cost are worsened
Solution Approach 1:
The system enables self-service authentication where users can generate their own key pairs and manage their authentication credentials without requiring complex centralized key management infrastructure. This reduces device complexity while maintaining security through distributed key portions.
3Ease of operation
If traditional authentication methods are used, then ease of operation is maintained, but vulnerability to phishing and impostor website attacks is worsened
Solution Approach 1:
The system introduces an intermediary verification mechanism using cryptographic proofs and challenge-response protocols that mediate between the user and the authentication server. This intermediary layer prevents phishing attacks by ensuring that authentication occurs only with legitimate servers that possess the corresponding public key, while maintaining ease of operation through automated verification.
Data Source
AI summary
To establish credentials, a user network station transmits a first value. An authenticating entity network station generates a first key portion based on the transmitted first value and a second value unknown to the user, splits one of a private key and a public key of a user asymmetric crypto-key into the first key portion and a second key portion, stores the second key portion of the one key so as to be accessible only to the authenticating entity network device, generates a cookie including the second value, transmits the generated cookie to the user network station, and destroys the transmitted first value, the second value, the one key, and the first key portion of the one key. The first value represents a first and the second value included in the transmitted cookie represents a second user credential useable to authenticate the user.