Counting Bloom Filter for Secure Credential Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems using usernames and passwords are vulnerable to unauthorized access due to password leakage and reuse, as malicious actors can exploit shared credentials across multiple accounts, and storage of passwords poses security risks.
Innovation Solution
A method utilizing a counting Bloom filter data structure to manage and track corporate credentials, allowing access to enterprise resources while preventing use on external resources, by incrementing/decrementing counter values in the data structure to record and remove credentials, ensuring secure access without storing actual credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored for authentication, then access control functionality is enabled, but security risk increases due to potential leakage and compromise of stored credentials
Solution Approach 1:
The patent extracts the actual password storage function and replaces it with a Bloom filter data structure that stores only hashed representations. The authentication manager checks credentials against the Bloom filter without ever storing or handling plain-text passwords, thus removing the security vulnerability while preserving authentication capability.
Solution Approach 2:
The Bloom filter acts as an intermediary between the credential verification system and actual password data. It provides a probabilistic membership test that enables authentication decisions without requiring the system to store or access actual password values, thereby eliminating the security risk of password leakage.
2Reliability
If actual password data is stored for verification, then credential validation is possible, but vulnerability to attacks increases due to exposure of stored secrets
Solution Approach 1:
The patent removes the vulnerable element (actual password storage) while extracting and preserving the essential function (credential validation). The Bloom filter stores only cryptographic hashes and enables membership testing, providing validation capability without exposing secrets to attacks.
Solution Approach 2:
The system uses disposable cryptographic hashes instead of persistent password storage. Each credential verification generates temporary hash representations that are immediately processed and discarded, never stored in a vulnerable manner, thus eliminating the target for attacks while maintaining validation reliability.
3Adaptability or versatility
If previous passwords are retained for password change operations, then password update functionality works, but security risk increases from keeping old credentials
Solution Approach 1:
The patent extracts the password change functionality from the vulnerable pattern of retaining old passwords. The Bloom filter enables the system to verify that a new password is different from previous ones by checking hash representations, without actually storing or retaining access to old credential values.
Solution Approach 2:
The Bloom filter serves as an intermediary that enables password change operations by providing probabilistic membership tests on hashed credentials. The system can determine whether a new password matches previous ones through hash comparison without ever exposing or retaining actual old password data, thus enabling functionality while reducing security risk.
Data Source
AI summary
In one aspect, the present disclosure relates to a method including: determining whether first data representative of a first string of content used by a user to access an application is present within the data structure having positions that contain values representative of strings of content; responsive to determination that the first data is not present within the data structure, retrieving a value from an index using a key associated with the user, the value being derived from positions in the data structure that contain values representative of a second string of content previously used by the user to access the application; decrementing the values of the positions in the data structure representative of the second string of content to remove second data representative of the second string of content from the data structure; and adding the first data representative of the first string of content to the data structure.