Distributed Secret Key Authentication via Secure Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems using one-time passwords (OTPs) are vulnerable to security breaches if the authentication database is hacked, as they rely on centralized secret keys that can be stolen, compromising the security provided.
Innovation Solution
Divide a secret key into shares and store each share on different servers, using a secure computation protocol to authenticate users without any server having access to the entire key, enabling secure data encryption and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized authentication database storing secret keys is used, then authentication functionality is achieved, but security is compromised when the database is hacked
Solution Approach 1:
The secret key is divided into multiple shares using secret sharing schemes, with each share stored on a different server. No single server possesses the complete secret key, thereby eliminating the security vulnerability of centralized storage while maintaining authentication functionality.
Solution Approach 2:
A secure computation protocol acts as an intermediary mechanism that enables authentication operations on secret key shares without requiring any single server to access the complete secret key. The protocol facilitates secure collaboration between servers holding different shares.
2Reliability
If secret key shares are distributed across multiple servers, then security against database hacking is improved, but system complexity increases
Solution Approach 1:
The secure computation protocol serves as an intermediary that abstracts the complexity of distributed secret key management. It provides a standardized interface for authentication operations, shielding users and application logic from the underlying complexity of share-based security.
Solution Approach 2:
The secure computation protocol is designed to handle multiple authentication operations and different types of cryptographic functions through a unified framework, reducing overall system complexity by avoiding the need for separate mechanisms for each operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of securing data, the method comprising: dividing a secret key into a plurality of secret key shares; storing each of the plurality of secret key shares in a different server of a plurality of servers so that none of the servers has access to the secret key and to the secret key share stored in another of the servers; using a server of the plurality of servers to execute a secure computation protocol to determine a value of a function responsive to all of the plurality of secret key shares without providing any of the plurality of servers with access to the secret key and to the secret key share stored in another of the servers; and using the calculated value of the function to secure the data.