Deterministic Hashing for Site-Specific Password and Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password and personal data management systems face issues such as password reuse across multiple sites, exposure of personal information leading to data breaches, and reliance on vendor security practices, which can result in compromised user privacy and liability.
Innovation Solution
A deterministic hash function is applied to user inputs to generate site-specific, obfuscated values for passwords and personal data, ensuring unique responses for each website without storing clear text information, thus preventing data exposure and reducing reliance on vendor security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords and personal data are stored in clear text for authentication and password reset, then ease of operation is improved, but security and privacy are worsened
Solution Approach 1:
The system applies a deterministic hash function to passwords and personal data before storage, transforming them into obfuscated values in advance. This preliminary action ensures that even if the database is compromised, the stored values cannot be easily reversed to obtain original credentials, thus resolving the contradiction between operational convenience and security.
Solution Approach 2:
The patent introduces a deterministic hash function as an intermediary between the original data and its stored representation. This intermediary transforms sensitive data into a form that maintains functionality for authentication while eliminating direct exposure risks, effectively mediating between ease of operation and security concerns.
2Ease of operation
If the same password is used across multiple websites, then ease of operation is improved, but security is worsened due to cross-site contamination
Solution Approach 1:
The system modifies the deterministic hash function to incorporate website-specific parameters (such as domain name or site identifier) into the hashing process. This creates locally unique hash values for each website while maintaining the same underlying password, ensuring that a breach at one site does not compromise credentials at other sites.
Solution Approach 2:
The patent segments the authentication process by creating site-specific hash values that are independent for each website. This segmentation ensures that even if one site's database is compromised, the attack cannot be transferred to other sites, as each site's authentication relies on its own unique hash parameters.
3Adaptability or versatility
If personal information is collected for password reset, then adaptability is improved, but security is worsened due to data exposure risks
Solution Approach 1:
The system applies deterministic hashing to personal information (such as security questions or recovery data) before storage, transforming them into obfuscated values in advance. This ensures that even though personal information is collected for password reset functionality, the stored data cannot be easily reversed to obtain original personal details, resolving the contradiction between adaptability and data exposure risks.
4Device complexity
If vendor security practices are relied upon, then device complexity is reduced, but reliability is worsened due to dependency on external security
Solution Approach 1:
The patent introduces a deterministic hash function as an intermediary layer between user credentials and storage, creating a security mechanism that does not depend on vendor practices. This intermediary transformation ensures that even if vendor security fails, the hashed values provide an additional layer of protection, improving reliability without significantly increasing complexity.
Data Source
AI summary
There is disclosed herein a computing apparatus having a hardware platform, including a processor circuit and a memory; a web-enabled application; and stored instructions within the memory to instruct the processor circuit to: determine that an input field of the web-enabled application has requested a password or personal data from a user; receive an input value; apply a deterministic function to the input value to create an obfuscated value; and provide the obfuscated value as an input to the input field.