Password Security via CAPTCHA Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password security methods over insecure HTTP connections are vulnerable to interception and attacks, and implementing secure HTTP connections is costly and prone to 'man in the middle' attacks, even when properly administered.
Innovation Solution
A password security system that incorporates CAPTCHA-based hashing, where a client-side script generates a hash value from a password and a CAPTCHA answer, which is then verified by the server to ensure secure data access, providing an additional layer of security without the need for expensive infrastructure changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure HTTP connection is implemented, then password security is improved, but implementation cost and operating cost increase
Solution Approach 1:
The patent introduces a CAPTCHA challenge as an intermediary element between the user and the password authentication process. The CAPTCHA answer is combined with the password to create a composite credential that is hashed and transmitted to the server. This intermediary mechanism prevents attackers from directly intercepting and reusing passwords, as the CAPTCHA component cannot be obtained through eavesdropping on network traffic.
Solution Approach 2:
The system performs preliminary action by requiring users to solve a CAPTCHA challenge before password authentication occurs. The CAPTCHA answer is obtained and stored temporarily, then combined with the password during the authentication process. This preliminary step ensures that even if the password transmission is intercepted, the attacker cannot authenticate without the pre-obtained CAPTCHA answer.
2Ease of operation
If plain text password is transmitted over insecure HTTP, then ease of operation is improved, but vulnerability to interception increases
Solution Approach 1:
The CAPTCHA answer serves as an intermediary that is combined with the password before transmission. This creates a composite credential where the password component cannot be separately extracted or reused by attackers who intercept the transmitted data. The intermediary element effectively neutralizes the vulnerability of plain text transmission.
Solution Approach 2:
Instead of transmitting the actual password, the system transmits a hash value that is a cryptographic copy or representation of the password combined with the CAPTCHA answer. This copying approach allows authentication to proceed while preventing attackers from obtaining the actual password through interception.
3Reliability
If one-way hash function is applied to password, then cryptographic strength is improved, but susceptibility to dictionary and brute force attacks remains
Solution Approach 1:
The patent merges the password with the CAPTCHA answer to create a composite credential before applying the hash function. This combining approach ensures that even if an attacker has computational resources for dictionary or brute force attacks, they cannot succeed without knowing both the password and the CAPTCHA answer, which are obtained at different times and through different mechanisms.
Solution Approach 2:
The system performs preliminary action by obtaining and storing the CAPTCHA answer before the password authentication occurs. This pre-obtained CAPTCHA answer is then combined with the password during hashing, creating a time-dependent authentication mechanism that prevents offline dictionary and brute force attacks, as the hash cannot be computed without the temporarily available CAPTCHA answer.
4Reliability
If secure HTTP connection is implemented, then protection against man in the middle attacks is improved, but additional operating costs and complexity increase
Solution Approach 1:
The CAPTCHA challenge acts as an intermediary mechanism that provides protection against man in the middle attacks without requiring complex cryptographic infrastructure. The intermediary CAPTCHA answer, when combined with the password, creates an authentication credential that cannot be intercepted or reused, thereby providing protection with simpler system requirements.
Data Source
AI summary
A password security system, hosted by a server, whose method of operation may include receiving a client hash value from a client where the client hash value is computed by hashing a password to generate a first hash value, and hashing the first hash value combined with a user input of an answer to a challenge to generate the client hash value. A server hash value is computed using password data for the user that is stored in a data store coupled to the server and a server-side answer that is stored in the data store. A determination is made whether the server hash value matches the client hash value and data access is granted to the user in view of a determination that the server hash value matches the client hash value, and data access is denied to the user in view of a determination that the server hash value does not match the client hash value.