Blinded Passwords for Distributed Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed storage systems face vulnerabilities to brute-force attacks when a threshold number of authentication servers are compromised, allowing attackers to attempt millions of password attempts per second, compromising security.
Innovation Solution
Incorporating a key derivation function with parameters such as iteration count and additional security measures, like blinded password generation and key regeneration, to make password cracking computationally expensive and time-consuming, thereby limiting brute-force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed storage system stores credentials on multiple authentication servers, then system availability and fault tolerance are improved, but security against brute-force attacks deteriorates when servers are compromised
Solution Approach 1:
The patent segments the credential verification process by distributing password hashing across multiple authentication servers. Each server stores only a portion of the hashed password (split into multiple shares), so that no single server contains the complete credential. This segmentation maintains system availability through distribution while mitigating brute-force attack risk, as compromising one server does not expose the full password.
Solution Approach 2:
The patent transforms the password into a different parameter form by applying cryptographic hashing functions (e.g., PBKDF2, bcrypt, scrypt) that convert plaintext passwords into hashed representations. This parameter change makes the stored credentials computationally infeasible to reverse, thereby protecting against brute-force attacks while maintaining authentication functionality.
2Object-affected harmful factors
If password hashing with key derivation function is implemented, then security against brute-force attacks is improved, but computational cost and processing time increase
Solution Approach 1:
The patent performs password hashing and key derivation in advance during the authentication server setup phase, before any authentication requests are processed. The computationally intensive operations (hashing with iteration counts, memory-hard functions) are executed preliminarily to generate stored hash values, so that during actual authentication, only comparison operations are needed. This preliminary action shifts the computational burden away from real-time processing.
Solution Approach 2:
The patent implements iterative hashing processes where the key derivation function is applied repeatedly for a specified number of iterations (e.g., PBKDF2 with 1000+ iterations). This periodic application of the hashing function increases computational cost proportionally to the iteration count, making brute-force attacks exponentially more difficult while maintaining a controlled balance between security and performance.
Data Source
AI summary
A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method begins by performing a key derivation function on a password and issuing a set of blinded passwords to a set of storage units. The method continues by receiving at least a decode threshold number of confidential information responses, regenerating a set of keys using the associated passkeys of the confidential information, decrypting a set of encrypted slices of the confidential information using the set of keys to reproduce a set of encoded data slices, and dispersed storage error decoding a decode threshold number of the set of reproduced encoded data slices to produce recovered data.