Personal Device Password Hashing for Phishing Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in managing and remembering multiple strong, unique passwords for various accounts, leading to security vulnerabilities such as weak password usage and reusing passwords across different accounts, which are not effectively addressed by existing password management techniques.
Innovation Solution
A security-enhanced login technique that uses a personal device, such as a mouse, in conjunction with a password to generate a strong, unique password for each server, without requiring server-side modifications, by hashing the password with the server's ID and a secret stored on the device, providing two-factor authentication and resisting phishing and dictionary attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users use strong, unique passwords for each account to enhance security, then security against dictionary attacks and phishing is improved, but password management complexity and user burden increase
Solution Approach 1:
The system segments the password management task by separating the master password (user remembers) from the derived passwords (system generates). Each account receives a unique derived password through hashing the master password with account-specific identifiers, eliminating the need for users to manage multiple complex passwords while maintaining strong security for each account
Solution Approach 2:
The system performs preliminary password generation and storage in a password database before login. When users need to access an account, the system automatically retrieves and supplies the pre-generated strong password, eliminating the need for users to manually create or remember multiple strong passwords
2Ease of operation
If users reuse the same weak password across multiple accounts to simplify management, then ease of use is improved, but security vulnerability increases due to phishing and compromise risks
Solution Approach 1:
The system introduces a master password as an intermediary that users remember, which then serves as the basis for generating all account-specific passwords through cryptographic hashing. This intermediary approach allows users to have simple password management (one master password) while the system handles the complexity of generating and managing unique strong passwords for each account, thereby maintaining both ease of use and security
3Ease of operation
If a master password encrypts all user names and passwords to help users remember credentials, then password management convenience is improved, but security is compromised if the master password is obtained through phishing
Solution Approach 1:
The system transforms the master password into different account-specific passwords through cryptographic hashing with unique account identifiers (usernames, domain names). This parameter change ensures that even if one account's credentials are compromised through phishing, the master password cannot be used to access other accounts since each derived password is cryptographically unique, thereby providing security isolation while maintaining convenience
4Reliability
If password-based authenticated key exchange protocols are used to protect against dictionary attacks, then security is improved, but deployment complexity increases due to server modification requirements
Solution Approach 1:
The system implements password-based authenticated key exchange functionality on the client side through browser extensions or local software, allowing users to generate and manage strong unique passwords locally without requiring server modifications. The client automatically handles password generation, encryption, and transmission, making the system self-sufficient and eliminating complex server-side deployment requirements while maintaining strong security
Data Source
AI summary
A security-enhanced login technique that provides a convenient and easy-to-use two factor technique to enhance the security of passwords without requiring any changes on the server side of a client-server network. The technique employs a convenient and easy-to-use two-factor technique to generate strong passwords for Web and other applications. In this technique, a convenient or personal device such as a mouse is used as the other factor besides a user password. A secret stored in the mouse or other personal device is hashed together with the password entered by a user and the server ID, to generate a strong, server-specific password which is used to authenticate the user to the server. This password enhancement operation is carried out inside the personal device.