Client-Server Credential Authentication via Decryption Key Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network security systems are vulnerable to wholesale theft of credential verification information stored on servers, as attackers can exploit weaknesses such as brute force attacks and reverse engineer authentication credentials, even with advances in computational power and distributed cracking algorithms.

Innovation Solution

A computer-implemented method where a server receives a decryption key from a client device to decrypt and verify authentication credential data, comparing the decrypted data with the received data to authenticate the user, while deleting all unencrypted data and keys post-authentication to prevent large-scale credential data leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If credential verification information is stored on the server for authentication, then user authentication can be performed, but the server becomes vulnerable to wholesale theft of credentials in case of compromise

Engineering Contradiction:

Improveauthentication capabilityVSAvoidcredential theft risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The credential verification system is segmented into two parts: encrypted credential verification information stored on the server, and decryption keys stored on the client device. This segmentation ensures that even if the server is compromised, attackers cannot access usable credentials without the client-side decryption keys.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Encrypted credential verification information acts as an intermediary between the stored data and the authentication process. The server stores only encrypted versions of credentials, which cannot be used for authentication without the corresponding decryption keys held by the client device.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If decryption keys are stored on the client device for each user, then credential verification security is improved, but device complexity and key management burden increase

Engineering Contradiction:

Improvecredential protection levelVSAvoidkey management complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

Instead of the traditional model where the server stores all credential verification information, this system inverts the approach by storing encrypted credential verification information on the server and the decryption keys on the client device. This inversion shifts the critical security component from the server to the client.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

Each client device autonomously manages its own decryption keys locally without requiring centralized key management infrastructure. The client device independently performs decryption and verification operations using its stored keys.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10277591B2Protection and verification of user authentication credentials against server compromise

Publication Date: 2019.04.30 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Authenticating a user is provided. A decryption key corresponding to an authentication account of the user of a client device and authentication credential data obtained from the user of the client device is received during authentication. Encrypted authentication credential data corresponding to the user is decrypted using the received decryption key corresponding to the authentication account of the user. The decrypted authentication credential data is compared with the received authentication credential data to authenticate the user of the client device.