Dynamic Security Function Selection for Database Secret Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for storing secrets in databases, such as hashing and salting, may not be sufficient to prevent cybercriminals from retrieving original secrets, especially when the salt is compromised.
Innovation Solution
A method that dynamically applies one or more security functions from a set of available functions to increase the complexity of secrets before storing them in a database, making it impossible for cybercriminals to determine the original secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hashing function is used to store secrets, then the original secret cannot be retrieved even if stored value is stolen, but the hashed value can still be cracked under certain circumstances and computation cost
Solution Approach 1:
The patent applies a dynamic selection mechanism where different security functions are chosen based on a time schedule or other criteria. Instead of using a static hashing function, the system dynamically selects from multiple available security functions, making it impossible for attackers to use precomputed tables or predict the transformation applied to secrets.
Solution Approach 2:
The patent changes the parameter of the security function itself by selecting different functions from a set of available functions. This parameter change (which function to use) is determined dynamically, thereby increasing the complexity for attackers who would need to determine both the function and its parameters to crack the secrets.
2Reliability
If salt is added before hashing, then precomputed tables become less effective, but the salt itself can be compromised and the protection is limited
Solution Approach 1:
Instead of using a static salt value, the patent employs dynamic security function selection. The function chosen changes over time or based on certain criteria, making the security mechanism adaptive and significantly more robust against attacks that exploit static protection mechanisms like traditional salting.
Solution Approach 2:
The system performs preliminary action by pre-configuring a set of security functions and establishing a selection criterion (such as a time schedule) before actual secret storage. This preliminary setup enables the system to dynamically adapt its security approach without requiring real-time computation of selection criteria during secret storage operations.
3Reliability
If multiple security functions are dynamically selected and applied, then the treatment applied to secrets becomes unknown and undeterminable to cybercriminals, but the system complexity increases
Solution Approach 1:
The patent implements dynamic selection of security functions based on a time schedule or other criteria. This dynamic approach ensures that the treatment applied to secrets changes over time, making it undeterminable for attackers. The system manages this complexity through automated selection mechanisms rather than requiring manual configuration of multiple functions.
Solution Approach 2:
The system achieves multi-functionality by having a single security mechanism that can select from multiple different security functions. This universal approach allows the system to provide various levels and types of security protection through one unified mechanism, rather than requiring separate systems for each security function.
Data Source
Figure 1~2
Figure 3~4
AI summary
Method for storing a provided secret (m1) into a database (DB) deployed on a server (5) connected to a telecommunication network (N), said method comprising steps performed by said server (5) of: - identifying (S1) at least one security function among a set of security functions available at a security service (SS), said security functions being adapted to increase a complexity criterion of any secret; - applying (S2) said at least one security function to said provided secret; - storing (m4) said provided secret (m1) into said database (DB).