Authentication System Using Distributed Shares for Multi-Party Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems face challenges in securing user authentication information, particularly due to vulnerabilities in server-side offline attacks and the assumption of a secure area in user devices, which can lead to unauthorized access and impersonation.
Innovation Solution
An authentication system that employs user side assistance devices to perform multi-party computation using distributed shares of verification information and secret keys, eliminating the need for a secure area in user devices and enhancing security against server-side attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If verification information is stored in the authentication server, then user authentication can be performed, but the server becomes vulnerable to offline attacks and information leaks
Solution Approach 1:
The verification information is segmented into multiple distributed shares using secret sharing schemes. Each share is stored in different locations (user device, authentication server, and assistance devices), so that no single entity possesses the complete verification information. This segmentation prevents offline attacks on the server from compromising user credentials.
Solution Approach 2:
User side assistance devices are introduced as intermediaries between the user device and authentication server. These assistance devices hold distributed shares of verification information and participate in multi-party computation to verify authentication without exposing the complete verification information to the authentication server, thereby preventing server-side attacks.
2Reliability
If a secure area is implemented in user devices, then verification information can be protected, but device complexity and security assumptions increase
Solution Approach 1:
The requirement for a secure area in user devices is extracted and replaced by distributing verification information shares to user side assistance devices. The user device itself does not need to implement complex secure storage, as the security function is externalized to assistance devices that participate in multi-party computation.
Solution Approach 2:
User side assistance devices serve multiple functions: they store distributed shares of verification information, perform multi-party computation with the user device, and interact with the authentication server. This multi-functionality eliminates the need for dedicated secure hardware in user devices while maintaining security.
3Reliability
If distributed shares and multi-party computation are used, then security against server attacks is enhanced, but system complexity and computational overhead increase
Solution Approach 1:
Distributed shares of verification information are pre-computed and stored in user side assistance devices before authentication occurs. This preliminary action allows the actual authentication process to use these pre-prepared shares in multi-party computation, reducing real-time computational complexity while maintaining security.
Data Source
AI summary
An authentication system is provided with: a user device; user side assistance device(s) to assist user authentication that authenticates a user of the user device, and apparatus authentication that authenticates the user device; and an apparatus authentication server device to perform apparatus authentication in association with the user device. The user side assistance device(s) use distributed shares of verification information to perform multi-party computation for user authentication in association with the user device, and use distributed shares of a secret key generated by the user device, to perform multi-party computation for apparatus authentication in association with the user device.