Decentralized Public-Key Authentication Without TPM Vendor Lock-In
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, such as those based on Trusted Platform Modules (TPMs) and cloud services, suffer from vendor lock-in, limiting interoperability and flexibility, and are vulnerable to data breaches and attacks like brute force and credential stuffing, due to centralized credential storage and reliance on hardware-based key encryption.
Innovation Solution
A computer-implemented system and method using private-public key cryptography to manage authentication between user devices and servers, involving user credential and device fingerprint retrieval, dynamic private key regeneration, and secure question-based authentication, decoupling from specific hardware and reducing reliance on centralized storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If centralized storage of user credentials is used, then authentication can be managed efficiently, but the system becomes vulnerable to data breaches and unauthorized access
Solution Approach 1:
The patent extracts private keys from centralized storage and distributes them to individual user devices. Each user device stores its own private key locally, eliminating the need for a central credential repository. This extraction of cryptographic materials from centralization directly resolves the contradiction by maintaining authentication efficiency while eliminating the single point of failure that enables data breaches.
Solution Approach 2:
The patent introduces public-key infrastructure as an intermediary mechanism between authentication servers and user devices. The public-key cryptography system enables secure authentication without requiring direct trust in centralized storage. The asymmetric key pairs act as intermediaries that allow authentication to proceed securely with distributed key storage, resolving the security-efficiency contradiction.
2Reliability
If hardware-based key encryption using TPMs is used, then security is improved, but vendor lock-in occurs limiting interoperability
Solution Approach 1:
The patent creates software-based copies of the key management functionality that can run on different operating systems and hardware platforms. Instead of relying on vendor-specific TPM hardware, the system implements cryptographic operations through software that can be deployed universally. This copying of security functionality across platforms eliminates vendor lock-in while maintaining security through distributed private key storage.
Solution Approach 2:
The patent implements a universal key management approach that works across multiple platforms and devices. The distributed key storage system can operate on any device with standard cryptographic capabilities, making the authentication system universally applicable. This multi-functionality across different hardware and software environments directly addresses the interoperability limitation imposed by vendor-specific hardware solutions.
3Ease of operation
If traditional password-based authentication is used, then ease of operation is maintained, but the system becomes vulnerable to brute force and credential stuffing attacks
Solution Approach 1:
The patent replaces the mechanical password verification system with a cryptographic system based on asymmetric key pairs. Instead of checking passwords against stored hashes, the system uses public-key cryptography where the public key can be freely distributed for authentication while the private key remains secure on the user device. This substitution eliminates the vulnerability to brute force and credential stuffing attacks while maintaining ease of operation through automatic cryptographic verification.
Data Source
AI summary
A computer-implemented method and system for managing an authentication between user devices and authentication servers, is disclosed. The computer-implemented method includes: obtaining user credentials associated with users; retrieving information associated with device fingerprints corresponding to the user devices; generating cipher messages by at least one of: creating random numbers and encrypting the random numbers with keys derived from at least one of: the first and second index; transmitting the one or more user identities, the first index, the second index, and the cipher messages, to authentication servers; dynamically generating the private keys from private key variables; generating authentication responses by decoding authentication based questions obtained from the authentication servers, using cipher messages and the private keys; and transmitting the authentication responses to the authentication servers for adapting the authentication servers to authenticate the user devices.