Authenticating Device Secure Registration via Hash Parameters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional online identity authentication methods are vulnerable to attacks, such as password guessing and interception, especially when passwords are short or weak, leading to potential breaches of personal and property information.
Innovation Solution
A method and device that involve an authenticating device in the identity authentication process, where the client and server interact through an authenticating device to securely register and authenticate users, using hash operations and signature verification to protect private keys and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then the authentication process is simple and fast, but the security is vulnerable to attacks such as password guessing and interception
Solution Approach 1:
The patent introduces an authenticating device as an intermediary component between the client and server. This device generates and stores private keys locally, acting as a mediator that enables secure authentication without requiring the server to store sensitive password data. The authenticating device mediates the authentication process by providing cryptographic proof of identity through public key infrastructure, thereby enhancing security while maintaining system feasibility
Solution Approach 2:
The patent replaces the traditional mechanical password verification system with a cryptographic-based authentication mechanism. Instead of transmitting and verifying passwords through conventional channels, the system uses hash operations, digital signatures, and public key cryptography. This substitution transforms the authentication mechanism from a vulnerable text-based system to a mathematically secure cryptographic system that resists guessing and interception attacks
2Reliability
If passwords are stored in the remote server, then user authentication can be performed, but the risk of password leakage increases when the server is compromised
Solution Approach 1:
The patent extracts the sensitive private key storage function from the remote server and places it in a dedicated authenticating device that resides on the client side. The server only stores public keys and authentication tokens, not the actual passwords or private keys. This extraction removes the vulnerability point where compromised servers could leak user credentials, as the critical secret material never resides on the server
Solution Approach 2:
The patent uses cryptographic copying where the client creates a public key copy from the private key and sends only this non-sensitive copy to the server. The server stores and verifies against this public key copy rather than the original private key or password. This copying mechanism allows authentication functionality while eliminating the risk of original credential leakage
3Ease of operation
If the client retains login information, then authentication can be performed, but the security risk increases if the client is compromised
Solution Approach 1:
The patent implements a mechanism where the client discards sensitive authentication data after use. The authenticating device generates temporary authentication tokens or signatures that are valid for a single authentication transaction and are then discarded. The private key itself is never transmitted or stored on the client in a retrievable form, but rather used in-memory for signature generation and immediately discarded, providing both convenience and security
Data Source
AI summary
A registering method involving an authenticating device includes: a client obtains a URI, obtains an application ID according to the URI, obtains a device registering request according to the application ID and a user identification input, and sends the request to a server; receives registering data from the server, and obtains a client data object according to a challenge value and the application ID in the registering data; hashes the client data object and the application ID to obtain a challenge parameter and an application parameter, sends registering request information combining the challenge parameter and application parameter; receives registering response information from the authenticating device, sends a key registering request combining the registering response information, client data object and session ID in the registering data to the server; and the registering is deemed successful if success information is received from the server, or is failed if otherwise.