Distributed Authentication via Nonce and Hashed Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring security and privacy for user data in a data cloud to prevent unauthorized access, while avoiding the transmission of passwords in clear text.
Innovation Solution
A method and apparatus that send a request to a data cloud without user identification, receive an authentication realm and nonce, prompt the user for a username and hashed password, and resend the request with an authentication header containing the user credentials, ensuring secure data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are transmitted in clear text for authentication, then authentication process is simple, but security is compromised
Solution Approach 1:
The patent transforms the password from its original clear-text form into a hashed cryptographic representation. This parameter change (from plaintext to hashed format) maintains the authentication functionality while fundamentally improving security by making the password irreversible and resistant to interception or database breaches.
Solution Approach 2:
The patent introduces a nonce (number used once) as an intermediary element in the authentication process. The nonce acts as a mediator between the client and server, allowing verification of credentials without transmitting the actual password. This intermediary mechanism enables secure authentication by replacing direct password transmission with a challenge-response protocol.
2Reliability
If passwords are hashed for security, then security is improved, but authentication complexity increases
Solution Approach 1:
The nonce serves as a simplifying intermediary that reduces authentication complexity. By using a challenge-response mechanism with the nonce, the system avoids complex mutual authentication protocols while maintaining security. The nonce enables the server to verify credentials without requiring the client to understand or implement complex cryptographic hash functions.
Solution Approach 2:
The client automatically generates and processes the hashed password locally using the nonce, performing the cryptographic transformation itself. This self-service approach eliminates the need for the server to perform complex hashing operations or manage password storage, simplifying the overall system architecture while maintaining security.
3Productivity
If user identification is included in initial data requests, then data access is direct, but unauthorized access risk increases
Solution Approach 1:
The patent performs preliminary authentication using hashed credentials and nonces before granting access to user data. This preliminary action (authentication) must be completed successfully before any data requests with user identification are processed. By establishing credentials in advance through secure hashing and challenge-response, the system enables subsequent direct data access while preventing unauthorized requests.
Data Source
Figure 1
Figure 2
AI summary
A method includes, in response to a need to access for a user certain stored data that requires authentication, sending a request for the stored data into a data cloud, the request not identifying the user. The method further includes receiving, from the data cloud, response information descriptive of an authentication realm and a single-use nonce; presenting the information descriptive of the authentication realm to the user and prompting the user for a user name and password; re-sending the request into the data cloud with an authentication header having user credentials generated at least in part using the response information, the user credentials comprising the user name and a hashed password; and if the user credentials are valid, receiving from the data cloud the requested stored data.