Bloom Filter Credential Verification via Private Set Intersection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions do not allow users to efficiently check if a combination of username and password credentials has been compromised, and there is a lack of secure methods for service providers to verify leaked credentials without revealing sensitive information.
Innovation Solution
The use of bloom filters, public-private key pairs, and salt values is implemented to securely determine if a credential has been compromised by generating subsets of compromised credentials, hashing them, and using lossy hash functions to index them into corresponding bloom filters, allowing for efficient and secure verification without exposing the entire set of leaked credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users send their credentials to a service provider for checking against leaked credentials, then the ability to detect compromised credentials is improved, but the security risk increases because credentials may be exposed during transmission or storage
Solution Approach 1:
The patent introduces Bloom filters as an intermediary data structure that allows verification of credential compromise without direct exposure of credentials. The Bloom filter contains hashed representations of leaked credentials, enabling the service provider to check user credentials against the filter without transmitting or storing actual credential data, thus mediating the verification process securely
Solution Approach 2:
The patent creates cryptographic copies (hashes) of credentials that preserve verification functionality while eliminating security risks. Instead of handling actual credentials, the system uses hashed representations that cannot be reverse-engineered to reveal original credentials, allowing verification through copies rather than originals
2Measurement precision
If the service provider stores the complete set of leaked credentials for verification, then the accuracy of credential checking is improved, but the security risk and data protection requirements worsen due to the sensitive nature of storing leaked credentials
Solution Approach 1:
The patent extracts only the essential verification property from leaked credentials by creating Bloom filters that contain hashed representations. This extraction removes the harmful sensitive information while preserving the ability to detect compromised credentials, allowing accurate verification without storing the actual credential data that would pose security risks
Solution Approach 2:
The patent transforms credentials through cryptographic hashing, changing their parameter representation from readable plaintext to irreversible hash values. This parameter transformation maintains the unique identification property needed for verification while eliminating the security vulnerability of storing readable credential data
3Adaptability or versatility
If public sources of leaked credentials are accessed and stored, then the comprehensiveness of credential verification is improved, but the risk of leaking the stored credential set during server breaches increases
Solution Approach 1:
The patent creates cryptographic copies (Bloom filters) of credential data that can be safely stored and transmitted. These filter structures contain hashed representations that provide verification coverage across all leaked credentials while being mathematically impossible to reverse into the original credential set, thus preventing credential leakage even if the server is breached
4Ease of operation
If detailed information about leaked credentials is provided to users, then the usefulness of the verification service is improved, but the risk of inferring additional compromised credentials increases
Solution Approach 1:
The patent extracts only the verification result (match/no match) from the credential checking process, providing users with sufficient feedback to know if their credentials are compromised without revealing information about other leaked credentials. This selective extraction maintains user service quality while preventing inference attacks
Data Source
AI summary
In an embodiment, a method is configured to detect compromised credentials, comprising: generating a plurality of bloom filters, wherein each bloom filter corresponds to a particular subset of a set of compromised credentials; receiving an index value from a client computing device; in response to receiving the index value, determining a target bloom filter corresponding to the index value, and sending the target bloom filter to the client computing device; receiving a first value from the client computing device; in response to receiving the first value, generating a second value based on the first value, and sending the second value to the client computing device.