Format-Preserving Cryptography Feedback for Brute-Force Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security mechanisms for protecting sensitive data on electronic devices, such as smartphones and tablets, are inadequate against brute-force attacks and unauthorized access, particularly on commodity hardware lacking hardware security modules.
Innovation Solution
A feedback-based data security process using format-preserving cryptography and security identifiers, where users confirm a unique security identifier upon accessing sensitive data, and incorrect attempts are met with false data values that maintain the correct format and reasonable values, making it difficult for attackers to determine incorrect credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security mechanisms (usernames and passwords) are used to protect sensitive data, then data can be accessed by authorized users, but hackers or third parties can determine these security mechanisms through brute-force attacks and gain unauthorized access
Solution Approach 1:
The patent implements a feedback mechanism by providing security identifiers to users that allow them to verify whether their credentials are correct. When users enter credentials, the system returns a security identifier that matches only if the credentials are correct, enabling users to iteratively correct incorrect credentials while preventing attackers from determining credential validity through automated attacks.
Solution Approach 2:
The patent changes the parameter of credential verification by introducing security identifiers as an additional verification layer. Instead of directly accepting or rejecting credentials, the system transforms the verification process into a multi-step interaction where credentials are validated against security identifiers, fundamentally changing how authentication parameters are checked and making brute-force attacks ineffective.
2Ease of operation
If feedback is provided to users to confirm correct credentials, then users can correct their credentials, but attackers may use this feedback to systematically determine correct credentials through automated attempts
Solution Approach 1:
The patent creates a composite security mechanism by combining multiple elements: credentials (usernames/passwords), security identifiers (visual/audible feedback), and format-preserving cryptography. This composite approach layers multiple security functions together, where the security identifier provides user-friendly feedback while the format-preserving cryptography prevents attackers from learning anything about credential validity, making the combined system resistant to both user errors and automated attacks.
3Reliability
If format-preserving cryptography is used to return false data values for incorrect attempts, then attackers cannot determine incorrect credentials, but the system requires additional processing complexity
Solution Approach 1:
The patent applies format-preserving cryptography that creates copies of data maintaining the same format as the original. When incorrect credentials are entered, the system generates false data values that are format copies of what correct data would look like, preventing attackers from determining credential validity while keeping the processing complexity manageable through efficient cryptographic implementations.
4Reliability
If security identifiers are displayed for user confirmation, then unauthorized attempts can be identified, but the access process requires additional user interaction steps
Solution Approach 1:
The patent implements preliminary action by pre-generating and displaying security identifiers to users before credential verification completes. This allows users to immediately see whether their credentials are correct without waiting for a separate verification step, reducing the perceived access time while maintaining strong security against unauthorized attempts.
Data Source
AI summary
Encryption of sensitive data on consumer devices is provided with format-preserving cryptography and feedback via the use of security identifiers. A request to access the sensitive data will specify user credentials for the access. The submitter is requested to confirm a security identifier for the requested access. An incorrect security identifier will be presented for incorrect credentials, which will be easy for a user to identify but not for an attacker or other unauthorized user. If the incorrect security identifier is confirmed, the device assumes the request was received from an unauthorized source. The sensitive data is stored under format-preserving cryptography, such that false data values can be generated that have the correct format. An unauthorized user receiving the false data will not be readily able to determine the data received is incorrect, and will be likely to discontinue the attack, particularly for an automated process.