Authentication Credential Protection via Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security technologies face challenges in securely storing and using authentication credentials, particularly due to vulnerabilities in hardware-based solutions and the risk of information leakage, as well as high costs and slow upgrades in hardware security measures.
Innovation Solution
An authentication credential protection method that generates secret information using a lock screen password and hardware secret information, splits the encryption key into segments, and stores these segments on different trusted devices, utilizing secure multi-party data splitting and computation to enhance security and reduce the risk of leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based devices are used to store secret information, then security is improved, but the system becomes vulnerable to hardware side-channel cracking and information leakage
Solution Approach 1:
The encryption key is divided into multiple key segments that are scatteredly stored on different trusted devices. No single device holds the complete key, making hardware side-channel attacks ineffective since compromising one device does not reveal the entire secret information.
Solution Approach 2:
A secure multi-party computation protocol is introduced as an intermediary mechanism that enables key recovery without any single device having full access to the key. The protocol allows collaborative decryption while maintaining security against hardware attacks.
2Object-affected harmful factors
If white-box encryption is used to store secret information on a backup device, then attack difficulty is increased, but security is not ideal
Solution Approach 1:
Instead of relying solely on white-box encryption, the system segments the encryption key into multiple parts stored on different devices. This combines the benefits of increased attack difficulty with improved security through distributed storage and secure multi-party computation.
3Reliability
If secret information is scatteredly stored on multiple devices, then security is improved, but device complexity increases
Solution Approach 1:
The secure multi-party computation protocol acts as an intermediary that simplifies the complexity of managing scattered key segments. The protocol provides a standardized mechanism for key recovery that reduces the operational complexity despite the distributed architecture.
4Reliability
If hardware security protection measures are implemented, then security is improved, but costs increase and upgrades become slow
Solution Approach 1:
The system replaces hardware-based security measures with software-based secure multi-party computation. This substitution eliminates the need for expensive hardware security modules while maintaining security through cryptographic protocols, thereby reducing costs and enabling faster upgrades.
Data Source
AI summary
This application provides an authentication credential protection method and system. The protection method includes the following steps: generating authentication secret information based on a lock screen password and hardware secret information of a first device; randomly generating, by the first device, a symmetric key, and using the symmetric key as an encryption key for the authentication secret information; splitting the encryption key into at least two first key segments by using a multi-party data splitting algorithm, where one of the at least two first key segments is stored on the first device; and sending, by the first device, another first key segment to a trusted device. In the foregoing technical solution, the authentication secret information is generated by using the lock screen password and the hardware secret information, increasing information complexity. In addition, different trusted devices are used to store the split key segments, improving security of the encryption key.