Authentication System Using Password-Based Encrypted Challenge-Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authentication in data processing systems is vulnerable to attacks, particularly Man-in-the-Middle (MITM) attacks, where hackers intercept user credentials like passwords during transmission, compromising security.
Innovation Solution
Implementing a second-level verification method where a server computing system encrypts a question based on a user's password, transmits it to the user computing system, receives an encrypted response, decrypts it using the password, and establishes a login session only upon successful verification, thereby reducing the risk of password exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If confidential information (password) is transmitted over a network for authentication, then authentication can be performed remotely, but the information becomes vulnerable to interception by hackers
Solution Approach 1:
The patent introduces an intermediary authentication mechanism where the server sends encrypted questions to the user's device, and the device returns encrypted responses. This intermediary layer of encryption prevents direct password transmission over the network, allowing remote authentication while protecting against MITM attacks.
Solution Approach 2:
The patent replaces the mechanical transmission of plain text passwords with an encryption-based system. Instead of directly transmitting the password, the system uses cryptographic encryption to protect the authentication data during network transmission, substituting the vulnerable mechanical transmission process with a secure cryptographic mechanism.
2Reliability
If encryption is applied to authentication questions and responses, then security against MITM attacks is improved, but the complexity of the authentication process increases
Solution Approach 1:
The patent implements self-service by having the user's device automatically handle the encryption and decryption of authentication questions and responses using stored cryptographic keys. The device autonomously performs these security operations without requiring manual intervention or complex user actions, thereby improving security while managing the complexity through automation.
Solution Approach 2:
The patent applies preliminary action by pre-storing encryption keys and authentication data on the user's device before the actual authentication occurs. This preliminary setup allows the device to quickly encrypt and decrypt authentication questions and responses during the login process, reducing the computational complexity burden during the actual authentication moment.
3Speed
If encryption keys are stored on the user computing system, then authentication speed is improved, but the risk of key compromise increases
Solution Approach 1:
The patent applies local quality by storing encryption keys specifically on the user's device (client-side) rather than centrally on the server. This localized storage enables fast authentication responses since the device can immediately use its own stored keys without network round-trips, while the distributed nature of key storage across multiple devices reduces the impact of any single key compromise.
Solution Approach 2:
The patent segments the authentication system into multiple independent components, each with its own encryption keys stored locally on respective devices. This segmentation ensures that compromising one device's keys does not affect other devices, distributing the risk and maintaining authentication functionality across the network even if individual keys are compromised.
Data Source
AI summary
Systems and methods for performing authentication may include encrypting, by a server computing system, a question based on a first password associated with a user and based on successful verification of user identification to generate an encrypted question; transmitting, by the server computing system, the encrypted question to a user computing system; receiving, by the server computing system, an encrypted response from the user computing system, the encrypted response associated with the encrypted question; decrypting, by the server computing system, the encrypted response based on the first password to generate a response; and establishing, by the server computing system, a login session with the user computing system based on successful verification of the response.