Decoy File Authentication for Secure Group Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security measures for protecting confidential information in computer systems are inadequate as they fail to prevent unauthorized access through exploitation of system vulnerabilities, and encryption alone does not sufficiently secure communication between group members.
Innovation Solution
A method and system that generate a secrets file and decoy files with indistinguishable characteristics, using an n-bit generator to create message digests for encryption keys, ensuring secure communication by encrypting and decrypting files within a group, while maintaining the secrecy of shared secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication credentials (username and password) are used at predefined entry points, then access control is simplified, but security is insufficient because nefarious individuals can exploit system vulnerabilities to create alternative entry points
Solution Approach 1:
The patent creates decoy files that are indistinguishable from the actual secrets file. These decoys replicate the same characteristics (size, modification time, name pattern) as the real secrets file, making it difficult for attackers to identify and access the actual confidential information even if they scan the file system.
Solution Approach 2:
The patent introduces an intermediary layer between the user and the secrets file through the use of decoys. Instead of directly accessing the secrets file, any access attempt must first distinguish the real file from the decoys, adding an intermediate verification step that enhances security without significantly complicating legitimate access.
2Reliability
If encryption is used to protect confidential information, then data security is improved, but communication between group members remains vulnerable to unauthorized access and information loss
Solution Approach 1:
The patent encrypts the actual secrets file and creates encrypted decoy files that mirror the encrypted real file. This ensures that even if an attacker intercepts or accesses the file system, they cannot distinguish which encrypted file contains the actual secrets, thereby securing communication between group members.
Solution Approach 2:
The patent segments the secrets into multiple files (one real, multiple decoys), each encrypted and indistinguishable from the others. This segmentation means that compromising one file does not compromise the entire system, as the attacker cannot determine which file contains the actual secrets.
3Device complexity
If a single secrets file is used for group communication, then system complexity is reduced, but security is weakened because the file can be easily identified and accessed by unauthorized users
Solution Approach 1:
The patent segments the single secrets file into multiple files with identical characteristics (name, size, modification time). This segmentation creates confusion for attackers while maintaining simplicity for legitimate users, as all files appear identical and the user simply needs to access any of them to obtain the secrets.
Solution Approach 2:
The patent creates multiple copies of the secrets file structure, including decoy files that replicate the exact characteristics of the real secrets file. This copying strategy makes the real file indistinguishable from the decoys, thereby enhancing security without adding noticeable complexity to the file management system.
Data Source
AI summary
A security application for a computing device, e.g., a mobile phone, allows generation of a secret according to a unique user input (e.g., user credentials). The secret is stored in a directory such that it is retrievable when the unique user input is received via a user interface of a device on which the security application executes or is coupled with. Responsive to receiving an identifier associated with the secret, the security application prompts, e.g., via a user interface of the mobile phone, entry of the unique user input; and, subsequently, verifies the unique user input. Following such verification, the security application provides the secret for use in encoding a communication with a remote computer-based station. Entry of the user credentials may be required prior to the security application generating the secret, and may be responsive to receipt of an invitation (e.g., from the remote computer-based station) to generate it.