Forward Secrecy Key Generation for Secure Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication systems face challenges in providing adequate security against offline dictionary attacks and physical attacks, especially in scenarios with limited connectivity and high-risk environments, where data needs to be editable and securely stored with different levels of security and usability.
Innovation Solution
A user equipment generates multiple keys, including perfect forward secrecy and limited forward secrecy keys, allowing for different security and usability levels, with the ability to select appropriate keys based on scenarios, and stores encrypted data in memory, ensuring that even if the device is stolen, data remains secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication with key derivation functions is used, then authentication simplicity and cost-effectiveness are improved, but security against offline dictionary attacks deteriorates
Solution Approach 1:
The patent segments the authentication system into multiple components: a password authentication component for simplicity and a separate key derivation component with salt for security. The salt is segmented as a separate random value that is combined with the password during key derivation, preventing direct dictionary attacks on the password itself while maintaining user-friendly password-based authentication.
2Reliability
If computational cost is increased to prevent brute-force attacks, then security is improved, but authentication efficiency deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-computing a salt value and storing it securely. During authentication, the salt is combined with the password through key derivation to produce authentication data. This preliminary setup allows the system to achieve strong security without requiring excessive computational resources during the actual authentication process, as the salt eliminates the need for repeated full dictionary attacks.
3Reliability
If perfect forward secrecy is implemented for all stored data, then security against password compromise is improved, but data editability and usability deteriorate
Solution Approach 1:
The patent applies local quality by differentiating the security requirements of different data types. Critical data that requires strong forward secrecy is protected with keys derived using the salt and password through multiple iterations. Less critical data that requires frequent editing uses simpler protection mechanisms. This allows the system to provide strong security where needed while maintaining usability for data that requires regular modification.
4Reliability
If multiple key derivation iterations are used, then security against dictionary attacks is improved, but computational overhead and authentication time increase
Solution Approach 1:
The patent applies partial action by using a moderate number of iteration steps in the key derivation function - enough to provide strong security against dictionary attacks but not so many as to cause excessive delays. The salt ensures that even with a reasonable number of iterations, the computational cost remains acceptable while security is significantly enhanced compared to un salted hashing.
Data Source
AI summary
Methods and apparatus for encrypting and storing data. The methods and apparatus provide different levels of security and usability. The methods and apparatus generate two or more keys based on a shared secret made available to a user equipment and a server. The two or more keys comprise at least one perfect forward secrecy key, and at least one limited forward secrecy key. The methods and apparatus encrypt data using at least one of the two or more keys. The methods and apparatus store the encrypted data in a memory of the user equipment and/or transmit the data from the user equipment to the server.