Authentication Ticket Handling With Volatile-Memory-Only Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network authentication operations, such as Kerberos and NTLM, are vulnerable to unauthorized access due to tickets being stored in non-secure locations, posing risks of theft and misuse.
Innovation Solution
Implementing a Network Authentication Service Security (NASS) that constrains authentication data structures (ADS) to volatile memory only, secured-memory-only, or multilayer-encrypted storage, preventing storage in non-volatile or external storage, and ensuring secure transmission with different encryption keys, while allowing only single-use authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication tickets are stored in non-volatile storage for persistence, then authentication reliability is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent applies this principle by making authentication tickets ephemeral - they are stored only in volatile memory and automatically deleted after use or when the session expires. This disposable approach ensures that even if an attacker gains access to the system, they cannot persistently store or retrieve authentication credentials, thereby eliminating the trade-off between persistence and security.
Solution Approach 2:
The patent extracts the authentication ticket storage function from non-volatile storage and relocates it to volatile memory only. By removing the persistence mechanism, the system eliminates the vulnerability window where tickets could be stolen from disk, while maintaining authentication functionality through temporary in-memory storage that automatically cleans up.
2Object-affected harmful factors
If multiple encryption layers are added to protect authentication data, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent segments the encryption protection into distinct layers: a first encryption layer for basic ticket protection and a second encryption layer for enhanced security. This segmentation allows the system to apply encryption progressively rather than requiring complex multi-layer encryption from the outset, reducing initial complexity while maintaining security flexibility.
Solution Approach 2:
The patent changes the encryption parameter dynamically based on the security requirement. The system can switch between single encryption and double encryption modes depending on the authentication context, allowing enhanced protection without mandating complex encryption architecture in all cases, thus managing complexity through parameter flexibility.
3Object-affected harmful factors
If authentication tickets are made ephemeral and deleted after use, then security against replay attacks is improved, but authentication speed decreases
Solution Approach 1:
The patent applies preliminary action by pre-establishing security contexts and encryption parameters before authentication occurs. The system prepares security frameworks in advance, allowing rapid authentication decisions without needing to perform complex security operations during the actual authentication process, thus maintaining speed while ensuring security through pre-configured measures.
Solution Approach 2:
The patent implements a fast-track authentication mechanism that rushes through the authentication process by minimizing intermediate steps. Once security context is established, the system能够快速 validate tickets without unnecessary delays, using optimized memory access patterns and direct validation paths to maintain high authentication speed even with ephemeral storage constraints.
Data Source
AI summary
Some embodiments provide or utilize technology which increases the security of network authentication operations, such as Kerberos operations, New Technology LAN Manager operations, or other network authentication operations which utilize security tickets or security tokens or both. In some embodiments, a user machine (also known as a client machine) receives an authentication data structure (ADS) which includes one or more security tickets or security tokens or both. Embodiments constrain the ADS according to at least one security requirement, such as a volatile-memory-only constraint, a secured-memory-only constraint, or a multilayer encryption constraint. Embodiments also transmit the ADS from the machine as a part of performing the network authentication service. Some embodiments inhibit virtual memory, or memory dumping, or both. Some embodiments bind the ADS to the user machine, and some embodiments limit ADS usage counts.