Decentralized Password Vault Using Public Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password management systems face security risks due to the potential exposure of password databases, as attackers can access encryption keys or hashed passwords, compromising entire organizations.
Innovation Solution
A system and method that utilize public-private key cryptography to generate and manage passwords, where the authentication service encrypts passwords with public keys from multiple devices associated with a user, storing only encrypted versions, and each device decrypts its respective password using its private key, ensuring decentralized key possession and enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwords are stored in a password database with encryption keys, then password authentication can be performed, but the security of the password database is compromised because attackers can access encryption keys or hashed passwords
Solution Approach 1:
The patent extracts the password from the centralized password database and places it in the client device. The server stores only encrypted password versions that cannot be decrypted without the client's private key. This removes the vulnerable element (decryptable passwords) from the server database while preserving authentication functionality.
Solution Approach 2:
The patent segments the password management system into multiple components: the client device holds the private key and can decrypt passwords, while the server holds encrypted password versions. This segmentation distributes security responsibilities and eliminates the single point of failure in centralized password storage.
2Object-affected harmful factors
If passwords are hashed in the password database, then security is improved, but there are cases where hashing is not possible or not enough
Solution Approach 1:
Instead of hashing passwords on the server and requiring clients to verify them, the patent inverts the approach: the server encrypts passwords and the clients decrypt and verify them. This inversion allows the system to work in cases where server-side hashing is not feasible or sufficient, as the security-critical decryption operation occurs on the client side.
3Object-affected harmful factors
If encryption keys are saved elsewhere from the password database, then security is improved, but the complexity of key management increases
Solution Approach 1:
The client device performs self-service by autonomously decrypting password versions using its own private key. The server does not need to manage or distribute encryption keys to multiple clients, as each client independently handles its own decryption. This reduces server-side key management complexity while maintaining security.
Data Source
AI summary
A computer-based system and method for securing passwords, including: obtaining, by an authentication service, a plurality of public keys, each associated with one of a plurality of devices associated with a user; generating, by the authentication service, a password for the user; sending, by the authentication service, the password to a password management entity; encrypting, by the authentication service, the password with each of the public keys, thus generating a plurality of encrypted passwords, each encrypted with one of the public keys and associated with a device of the plurality of devices; and deleting the password by the authentication service.