Encrypted Salt Storage for Password Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password security mechanisms in computing systems are inadequate in preventing password cracking and the acceptance of compromised passwords, as evidenced by frequent security breaches, with attackers able to access and exploit stored passwords due to the use of plain text salts and lack of mechanisms to detect and prevent the use of cracked passwords.
Innovation Solution
The implementation of a salted password protection method where a random salt value is combined with a password, hashed, and the salt is encrypted with a key derived from the password, storing the encrypted salt value instead of plain text salt, and using a combination of client and server side salts to enhance security, making it impractical for attackers to brute force password cracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If plain text salts are stored in the database, then password validation is simple and fast, but attackers can easily access and use the salts to crack passwords through brute force attacks
Solution Approach 1:
The patent introduces an encrypted salt value as an intermediary between the stored salt and the password validation process. The salt is encrypted using asymmetric cryptography (public key encryption) before storage, creating an encrypted salt value that serves as the intermediary. During validation, the encrypted salt is decrypted using the private key to retrieve the original salt for password hashing. This intermediary layer prevents attackers from directly accessing the plain text salt while maintaining the password validation functionality.
Solution Approach 2:
The patent applies preliminary encryption to the salt value before it is stored in the database. The salt is encrypted using the server's private key in advance, creating an encrypted salt value that is stored instead of the plain text salt. This preliminary action ensures that even if the database is compromised, the salt remains protected and cannot be directly used for password cracking, as the decryption requires the private key which never leaves the server.
2Reliability
If traditional password hashing is used without encrypted salts, then the system is easier to implement, but it is vulnerable to password cracking attacks as demonstrated by recent security breaches
Solution Approach 1:
The encrypted salt value acts as an intermediary that bridges the gap between traditional password hashing and enhanced security. The salt is encrypted using asymmetric cryptography before storage, creating an intermediary layer that maintains compatibility with existing password validation workflows while adding security. The encrypted salt is stored in the database alongside the hashed password, and during validation, it is decrypted to retrieve the original salt for hashing the provided password. This intermediary approach allows the system to maintain ease of implementation while significantly improving security posture.
Solution Approach 2:
The patent changes the parameter of salt storage from plain text to encrypted format. Instead of storing the salt as-is, it is encrypted using the server's private key, transforming it into an encrypted salt value. This parameter change ensures that the salt cannot be directly accessed or misused by attackers, as decryption requires the private key. The encrypted salt value maintains the same functional properties as the original salt while providing cryptographic protection, thus improving security without fundamentally changing the password validation mechanism.
3Reliability
If salts are encrypted with asymmetric cryptography, then password cracking becomes computationally infeasible, but the encryption and decryption operations require additional processing time
Solution Approach 1:
The encryption of the salt is performed in advance during system initialization or user registration, not during each password validation operation. The salt is encrypted using the server's private key and the encrypted salt value is stored in the database. During password validation, only the decryption operation is required, which is computationally less intensive than encryption. This preliminary action shifts the computational burden from the validation path to the setup path, minimizing the impact on password validation time while maintaining strong security against brute force attacks.
Solution Approach 2:
The encrypted salt value serves as an intermediary that enables efficient password validation while maintaining security. The decryption of the encrypted salt using the private key is a one-time operation during each validation, retrieving the original salt for password hashing. This intermediary approach allows the system to leverage the security of asymmetric cryptography without requiring continuous encryption/decryption cycles during validation, thus minimizing the time penalty while achieving brute force attack resistance.
Data Source
AI summary
Mechanisms are provided for salted password protection of computing resources. An entity identifier and password for authenticating an entity to access a protected computing resource are received. A salt value is generated as a random value that is combined with the password to generate a salted password. A hash value is generated based on a hash function and the salted password as an input to the hash function. Based on the password, an encryption key is generated for encrypting the salt value. The salt value is encrypted based on the encryption key and an encryption algorithm to generate an encrypted salt value. The entity identifier, hash value, and encrypted salt value are stored in a secured database for later retrieval to validate subsequent access requests specifying the entity identifier.