Hardware-Backed Password Authentication Binding Hash to Authenticator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication systems are vulnerable to offline brute force attacks due to the ability of attackers to perform high-speed guesses using modern hardware, existing solutions failing to adequately address these vulnerabilities.
Innovation Solution
Implementing hardware-backed password-based authentication by computing a hash using a password and a hardware-based authenticator, such as ARM TrustZone or Trusted Platform Module, which binds the password hash computation to the system's hardware, incorporating a high entropy secret and message authentication code or digital signature computation to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used due to its simplicity, then ease of operation is improved, but security against offline brute force attacks deteriorates
Solution Approach 1:
A hardware-based authenticator (HBA) is introduced as an intermediary component between the password input and the authentication verification. The HBA computes a hardware-bound hash of the password that can only be verified by the same hardware instance, preventing offline brute force attacks while maintaining password-based authentication simplicity for users
Solution Approach 2:
The patent replaces traditional software-based password hashing with hardware-based cryptographic operations. The hardware authenticator performs cryptographic hash computation and verification using dedicated security hardware, substituting the vulnerable software-based authentication mechanism with a more secure hardware-based system
2Reliability
If hardware-based authenticator is implemented to prevent offline brute force attacks, then security is improved, but device complexity increases
Solution Approach 1:
The hardware-based authenticator is designed to provide multiple security functions including password hashing, key generation, and cryptographic operations within a single integrated component. This multi-functionality reduces the need for multiple separate security modules, thereby limiting the increase in device complexity while maintaining enhanced security
Data Source
AI summary
A system, method, and computer program product are provided for performing hardware-backed password-based authentication. In operation, a system receives a request to access software utilizing password-based authentication. Further, the system receives a password for the password-based authentication. The system computes a hash utilizing the password and a hardware-based authenticator associated with hardware of the system. Moreover, the system verifies that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software.