Group Network Authentication Tokens Prevent Password Reverse-Engineering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password-based authentication mechanisms in group networks, such as ad-hoc and Personal Area Networks, are vulnerable to unauthorized access and password reverse-engineering due to the storage of hash values in devices, making them insecure and susceptible to automated attacks.
Innovation Solution
A bijective locking function is used to create authentication tokens from a common secret and password, which cannot be used to recreate the password or verify password guesses, ensuring that only matching tokens allow successful authentication, with all sensitive information erased after use, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hash values are stored in devices for password-based authentication, then authentication can be performed, but the password can be reverse-engineered through automated attacks
Solution Approach 1:
The patent extracts the vulnerable hash value storage mechanism and replaces it with authentication tokens that are derived from the password but cannot be reversed to obtain the password. The tokens are stored in devices instead of hash values, eliminating the reverse-engineering vulnerability while maintaining authentication functionality.
Solution Approach 2:
The patent introduces authentication tokens as an intermediary between the password and the authentication verification process. The tokens serve as a mediator that proves password knowledge without exposing the password itself or its reversible hash representation, thereby preventing automated password attacks.
2Ease of operation
If a common password is used for all group members, then network management is simplified, but security is compromised due to easy password retrieval and guessing
Solution Approach 1:
The patent segments the authentication mechanism by providing each group member with a unique authentication token derived from the common password. This allows the group to share a common password for management simplicity while each member's individual token provides unique security verification, preventing unauthorized access even if one token is compromised.
Solution Approach 2:
The patent transforms the authentication parameter from directly storing hash values of the common password to storing derived authentication tokens. This parameter change maintains the simplicity of using a common password for group management while fundamentally changing the security model to prevent password retrieval and guessing attacks.
3Reliability
If authentication tokens are created from password using bijective locking function, then password cannot be recreated or verified from tokens, but system complexity increases
Solution Approach 1:
The patent creates authentication tokens as cryptographic copies of the password through a bijective locking function. These tokens contain the necessary authentication information but cannot be reversed to obtain the original password. The copying process uses standard cryptographic functions that, while adding some complexity, provide robust security without requiring entirely new computational mechanisms.
Data Source
AI summary
The invention relates to password-based authentication in group networks. Each device has an authentication token irreversibly based on the password. The authentication involves a first device at which the password P is entered and a second device towards which the authentication occurs. The first device determines a check token Mj for the second based on the password and its own authentication token Rl and this check token is sent to the second device, where it is compared with the authentication token of that device. The procedure may include update of a device to exclude a non-trusted device from the group or change the password. Advantageous features are that the information in one device does not allow retrieval of the password and that the password is only exposed at one device, and only temporarily, during the authentication.